OpenControls Logo

STIG Viewer

STIGViewer Support

The F5 BIG-IP DNS implementation must protect the authenticity of communications sessions for zone transfers.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-265990F5BI-DN-300036SV-265990r1024864_ruleCCI-001184high
Description
DNS is a fundamental network service that is prone to various attacks, such as cache poisoning and man-in-the middle attacks. If communication sessions are not provided appropriate validity protections, such as the employment of DNSSEC, the authenticity of the data cannot be guaranteed.
STIGDate
F5 BIG-IP TMOS DNS Security Technical Implementation Guide2024-09-09

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09Session Integrity
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (30) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AU-10(1)Association of Identities
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
AU-9(3)Cryptographic Protection
1.00
CM-14Signed Components
1.00
CM-5(3)Signed Components
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00

+20 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.15
1.00
CCI1 mapping
CCI-001184
1.00

Details

Check Text (C-265990r1024864_chk)

If the BIG-IP is transferring zones from another non-BIG-IP DNS server perform the following. From the BIG-IP GUI: 1. DNS. 2. Zones. 3. Click on the Zone Name. 4. Under the TSIG section verify a "Server Key" is selected. From the BIG-IP Console, type the following commands: tmsh list ltm dns zone <name> server-tsig-key Note: Must return a value other than "none". If the BIG-IP appliance is not configured to protect the authenticity of communications sessions for zone transfers, this is a finding.

Fix Text (F-69816r1024863_fix)

From the BIG-IP GUI: 1. DNS. 2. Zones. 3. Click on the Zone Name. 4. Under the TSIG section, select a "Server Key" from the drop-down menu. 5. Click "Update". From the BIG-IP Console, type the following commands: tmsh modify ltm dns zone <zone name> server-tsig-key <TSIG key name> tmsh save sys config