Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification, Accreditation or Authorization Package, ports, protocols, and services documentation, and Ports, Protocols, and Services Management (PPSM) database. If the list of authorized sources and destinations is not available, this is a finding. Review the firewall configuration for each of the configured inbound zones and interfaces. Verify an ingress filter (e.g., Access Control List) is applied to each inbound zone/interface, including the management interface. Verify ingress filters for the management interface to block all transit traffic (i.e., any traffic not destined to the firewall itself). Verify that traffic accessing the firewall originates from the Network Operations Center (NOC). If an ingress filter is not configured for each active inbound zone or interface, this is a finding.