The firewall implementation must deny network traffic by default and allow network traffic by exception at all interfaces at the network perimeter.

The firewall implementation must deny network traffic by default and allow network traffic by exception at all interfaces at the network perimeter.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000202-FW-000126	SRG-NET-000202-FW-000126	SRG-NET-000202-FW-000126_rule		Low

Description
All inbound and outbound traffic must be denied by default. The firewall and perimeter routers must only allow traffic that is explicitly permitted. Similarly, allowing unknown or undesirable outbound traffic will establish a session state which may subsequently allow the firewall to permit the return of this undesirable traffic inbound.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000202-FW-000126_chk )
Inspect the policy filters installed on the firewall. Verify the perimeter firewall is configured in a deny-by-default posture. If the perimeter firewall is not configured in a deny-by-default posture for all inbound and outbound traffic, this is a finding.

Fix Text (F-SRG-NET-000202-FW-000126_fix)
Configure the inbound and outbound firewall interfaces to deny network traffic by default and allow network traffic by exception at all interfaces at the network perimeter.