The network element must check inbound traffic to ensure communications are coming from an authorized source and routed to an authorized destination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34144	SRG-NET-000195-DNS-NA	SV-44597r1_rule		Medium

Description
Spoofing source addresses occurs when a malicious user outside the network has created packets with source address belonging to the private address space of the target network. This is done in an attempt to slip through perimeter as a member host to gain access to internal resources or to conceal identity to perform an attack. It is imperative that all inbound and outbound traffic with spoofed or invalid source addresses are blocked. Ingress network traffic inspection is not a function of DNS.

Description

Spoofing source addresses occurs when a malicious user outside the network has created packets with source address belonging to the private address space of the target network. This is done in an attempt to slip through perimeter as a member host to gain access to internal resources or to conceal identity to perform an attack. It is imperative that all inbound and outbound traffic with spoofed or invalid source addresses are blocked. Ingress network traffic inspection is not a function of DNS.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42104r1_chk )
This is not a function of DNS.

Fix Text (F-38054r1_fix)
This requirement is NA for DNS. No fix required.