JUSX-AG-000036 - The Juniper SRX Services Gateway must generate log records when firewall filters, security screens and security policies are invoked and the traffic is denied or restricted.

Information

Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.

Security objects are data objects which are controlled by security policy and bound to security attributes.

By default, the Juniper SRX will not forward traffic unless it is explicitly permitted via security policy. Logging for Firewall security-related sources such as screens and security policies must be configured separately. To ensure firewall filters, security screens and security policies send events to a Syslog server and local logs, security logging must be configured one each firewall term.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Include the log and/or syslog action in all term to log packets matching each firewall term to ensure the term results are recorded in the firewall log and Syslog. To get traffic logs from permitted sessions, add 'then log session-close' to each policy. To get traffic logs from denied sessions, add 'then log session-init' to the policy.

Firewall filter:
[edit]
set firewall family <family name> filter <filter_name> term <term_name> then log

Examples:
set firewall family inet filter protect_re term tcp-connection then syslog
set firewall family inet filter protect_re term tcp-connection then log
set firewall family inet filter ingress-filter-v4 term deny-dscp then log
set firewall family inet filter ingress-filter-v4 term deny-dscp then syslog

Security policy and security screens:
set security policies from-zone <zone_name> to-zone <zone_name> policy <policy_name> then log

Example:
set security policies from-zone untrust to-zone trust policy default-deny then log

Item Details

Audit Name: DISA Juniper SRX Services Gateway ALG v3r3

Category: AUDIT AND ACCOUNTABILITY

Plugin: Juniper

Control ID: 5d841a6cb27ed2eb99bc0b6eb8219b37a0f308ce0b1f3a3a5a9f56f0940c482a

Detections

Analytics

JUSX-AG-000036 - The Juniper SRX Services Gateway must generate log records when firewall filters, security screens and security policies are invoked and the traffic is denied or restricted.

Information

Solution

See Also

Item Details