F5BI-LT-000307 - The BIG-IP Core implementation must be configured to inspect for protocol compliance and protocol anomalies in inbound HTTP and HTTPS traffic to virtual servers.

Information

Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols.

Since protocol anomaly analysis examines the application payload for patterns or anomalies, an HTTP proxy must be included in the ALG. This ALG will be configured to inspect inbound HTTP and HTTPS communications traffic to detect protocol anomalies such as malformed message and command insertion attacks. Note that if mutual authentication is enabled, there will be no way to inspect HTTPS traffic with MITM.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

If the BIG-IP Core provides intermediary/proxy services for HTTP and HTTPS communications traffic, configure the BIG-IP Core to inspect inbound HTTP and HTTPS communications traffic for protocol compliance and protocol anomalies.

Item Details

Audit Name: DISA F5 BIG-IP Local Traffic Manager STIG v2r4

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: F5

Control ID: 2202d84420eb29b16160d8d38eceb436ea566e8c6de06716a6a71da22bccea69

Detections

Analytics

F5BI-LT-000307 - The BIG-IP Core implementation must be configured to inspect for protocol compliance and protocol anomalies in inbound HTTP and HTTPS traffic to virtual servers.

Information

Solution

See Also

Item Details