OpenControls Logo

STIG Viewer

STIGViewer Support

The NSX-T Tier-1 Gateway Firewall must configure SpoofGuard to block outbound IP packets that contain illegitimate packet attributes.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251769T1FW-3X-000036SV-251769r856688_ruleCCI-002664medium
Description
If outbound communications traffic is not filtered, hostile activity intended to harm other networks may not be detected and prevented.
STIGDate
VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide2023-06-22

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01.4System Generated Alerts
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
SC-7(9)Restrict Threatening Outgoing Communications Traffic
1.00
SI-3Malicious Code Protection
1.00
SI-4(1)System-wide Intrusion Detection System
1.00
SI-4(22)Unauthorized Network Services
1.00
SI-4(5)System-generated Alerts
1.00
CCI1 mapping
CCI-002664
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.PS-04
1.00

Details

Check Text (C-251769r856688_chk)

From the NSX-T Manager web interface, go to Networking >> Segments, and for each Segment, view Segment Profiles >> SpoofGuard. If a Segment is not configured with a SpoofGuard profile that has Port Binding enabled, this is a finding.

Fix Text (F-55160r810201_fix)

To create a segment profile with SpoofGuard enabled do the following: From the NSX-T Manager web interface, go to Networking >> Segments >> Segment Profiles >> Add Segment Profile >> SpoofGuard. Enter a profile name and enable port bindings, then click "Save". To update a Segment's SpoofGuard profile, do the following: From the NSX-T Manager web interface, go to the Networking >> Segments, then click "Edit" from the drop-down menu next to the target Segment. Expand Segment Profiles, choose the new SpoofGuard profile from the drop-down list, and then click "Save".