The firewall implementation must check inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000195-FW-000121	SRG-NET-000195-FW-000121	SRG-NET-000195-FW-000121_rule		Medium

Description
Spoofing source addresses occurs when a malicious user outside the network has created packets with a source address belonging to the private address space of the target network. This is done in an attempt to slip through the perimeter as a member host to gain access to internal resources or to conceal identity to perform an attack. It is imperative that all inbound and outbound traffic with spoofed or invalid source addresses are blocked. If inbound traffic is not monitored to make sure source and destination of packets are authorized, then malicious users outside the network may be able to send packets to the private, trusted network.

Description

Spoofing source addresses occurs when a malicious user outside the network has created packets with a source address belonging to the private address space of the target network. This is done in an attempt to slip through the perimeter as a member host to gain access to internal resources or to conceal identity to perform an attack. It is imperative that all inbound and outbound traffic with spoofed or invalid source addresses are blocked. If inbound traffic is not monitored to make sure source and destination of packets are authorized, then malicious users outside the network may be able to send packets to the private, trusted network.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000195-FW-000121_chk )
If this function is performed by another network element, this is not a finding. Verify firewall ACLs or policy filters exist that monitor inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination. If ACLs or policy filters do not exist to monitor inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination, this is a finding.

Check Text ( C-SRG-NET-000195-FW-000121_chk )

If this function is performed by another network element, this is not a finding.

Verify firewall ACLs or policy filters exist that monitor inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination.

If ACLs or policy filters do not exist to monitor inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination, this is a finding.

Fix Text (F-SRG-NET-000195-FW-000121_fix)
Implement firewall ACLs or policy filters to monitor inbound traffic to ensure the communications are coming from an authorized source and routed to an authorized destination.