The firewall implementation must be configured to send an alert to designated personnel in the event of an audit processing failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37100	SRG-NET-000088-FW-000055	SV-48861r1_rule		Low

Description
Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the firewall becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the firewall is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of firewall to write to the central audit log.

Description

Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the firewall becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the firewall is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of firewall to write to the central audit log.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45472r1_chk )
View the list of configured alerts. Verify an alert is sent to designated personnel when the firewall is unable to write to the central audit log server. If the firewall is not configured to send an alert to designated personnel when an audit processing failure occurs, this is a finding.

Fix Text (F-42045r1_fix)
Configure the firewall implementation to send an alert to designated personnel when an audit processing failure is detected.