F5BI-LT-000031 - The BIG-IP Core implementation must be configured to monitor inbound traffic for remote access policy compliance when accepting connections to virtual servers.

Information

Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by inspecting connection activities of remote access capabilities.

A remote access policy establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed prior to allowing connections to the information systems.

Remote access methods include both unencrypted and encrypted traffic (e.g., web portals, web content filter, TLS, and webmail). With inbound TLS inspection, the traffic must be inspected prior to being allowed on the enclave's web servers hosting TLS or HTTPS applications. With outbound traffic inspection, traffic must be inspected prior to being forwarded to destinations outside of the enclave, such as external email traffic.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

If intermediary services for remote access communications traffic are provided, configure the BIG-IP Core as follows:

Configure a policy in the BIG-IP ASM module to monitor inbound traffic for remote access policy compliance.

Apply policy to the applicable Virtual Server(s) in the BIG-IP LTM module to monitor inbound traffic for remote access policy compliance when accepting connections to virtual servers.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_F5_BIG-IP_11-x_Y20M10_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(1), CAT|II, CCI|CCI-000067, Rule-ID|SV-215745r557356_rule, STIG-ID|F5BI-LT-000031, STIG-Legacy|SV-74701, STIG-Legacy|V-60271, Vuln-ID|V-215745

Plugin: F5

Control ID: c6ecae63fa20d9104d0b986f33fdda5cb392427ae619c3306d20d6828543af99