The F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259332	F5BI-DM-000163	SV-259332r947351_rule		Medium

Description
This security measure helps limit the effects of denial-of-service attacks by employing anti-session hijacking security safeguards. Session hijacking, also called cookie hijacking, is the exploitation of a valid computer session to gain unauthorized access to an application. The attacker steals (or hijacks) the cookies from a valid user and attempts to use them for authentication.

STIG	Date
F5 BIG-IP Device Management Security Technical Implementation Guide	2024-01-26

Details

Check Text ( C-63070r947349_chk )
From the BIG-IP GUI: 1. System. 2. Preferences. 3. Under "Security Settings", verify "Require A Consistent Inbound IP For The Entire Web Session" box is checked. If the BIG-IP appliance is not configured to require a consistent inbound IP for the entire session for management sessions, this is a finding.

Fix Text (F-62979r947350_fix)
Enable the "Require A Consistent Inbound IP For The Entire Web Session" setting using the Configuration utility. From the BIG-IP GUI: 1. System. 2. Preferences. 3. Under "Security Settings", check "Require A Consistent Inbound IP For The Entire Web Session". 4. Click "Update".