The firewall implementation must authenticate devices before establishing network connections using bidirectional authentication between cryptographically based devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000151-FW-000091	SRG-NET-000151-FW-000091	SRG-NET-000151-FW-000091_rule		Medium

Description
This requirement is for device to device authentication between firewall and other network devices. Without authentication, an unauthorized device may connect to the firewall and intercept monitored traffic, make configuration changes, or initiate man-in-the-middle attacks. Hence, it is imperative that authentication is bi-directional (mutual authentication) using cryptography to ensure a high level of trust and authenticity. Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device as deemed appropriate by the organization. The devices typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for identification or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local area networks.

Description

This requirement is for device to device authentication between firewall and other network devices. Without authentication, an unauthorized device may connect to the firewall and intercept monitored traffic, make configuration changes, or initiate man-in-the-middle attacks. Hence, it is imperative that authentication is bi-directional (mutual authentication) using cryptography to ensure a high level of trust and authenticity. Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device as deemed appropriate by the organization. The devices typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for identification or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local area networks.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000151-FW-000091_chk )
Verify direct firewall communications with other network devices (e.g., routers and sensors) are configured to establish bidirectional authentication before establishing communications. Verify the bidirectional authentication is between cryptographically based devices. If communication between the firewall and network devices does not use bidirectional authentication, this is a finding. If device authentication is not established using cryptographically based devices, this is a finding.

Check Text ( C-SRG-NET-000151-FW-000091_chk )

Verify direct firewall communications with other network devices (e.g., routers and sensors) are configured to establish bidirectional authentication before establishing communications.
Verify the bidirectional authentication is between cryptographically based devices.

If communication between the firewall and network devices does not use bidirectional authentication, this is a finding.
If device authentication is not established using cryptographically based devices, this is a finding.

Fix Text (F-SRG-NET-000151-FW-000091_fix)
Configure the firewall implementation to require bidirectional authentication when communicating with network devices. Use cryptographically based devices to perform the bidirectional authentication.