OpenControls Logo

STIG Viewer

STIGViewer Support

In the event that communication with the central audit server is lost, the F5 BIG-IP appliance must continue to queue traffic log records locally.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-266257F5BI-FW-300012SV-266257r1024871_ruleCCI-000140low
Description
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode. In accordance with DOD policy, the traffic log must be sent to a central audit server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system must either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the central audit server, action must be taken to synchronize the local log data with the central audit server. If the central audit server uses UDP communications instead of a connection oriented protocol such as TCP, a method for detecting a lost connection must be implemented.
STIGDate
F5 BIG-IP TMOS Firewall Security Technical Implementation Guide2024-09-09

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05Response To Event Log Processing Failures
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-3(2)Centralized Management of Planned Audit Record Content
1.00
AU-4Audit Log Storage Capacity
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.4
1.00
CCI1 mapping
CCI-000140
1.00

Details

Check Text (C-266257r1024871_chk)

If using Remote High Speed Logging (recommended): From the BIG-IP GUI: 1. Local Traffic. 2. Pools. 3. Pool List. 4. <Logging Pool Name> 5. Verify that "Enable Request Queueing" is set to "Yes". From the BIG-IP Console, type the following commands: tmsh list ltm pool <Logging Pool Name> queue-on-connection-limit Note: Verify this is enabled. If the BIG-IP appliance is not configured to queue traffic log records locally in the event that communication with the central audit server is lost, this is a finding.

Fix Text (F-70084r1024870_fix)

If using Remote High Speed Logging (recommended): From the BIG-IP GUI: 1. Local Traffic. 2. Pools. 3. Pool List. 4. <Logging Pool Name> 5. Verify that "Enable Request Queueing" is set to "Yes". Note: Configuration must be set to "Advanced" to view this option. From the BIG-IP Console, type the following commands: tmsh modify ltm pool <Logging Pool Name> queue-on-connection-limit enabled tmsh save sys config