The firewall implementation must produce application log records containing sufficient information to determine if the event was a success or failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37350	SRG-NET-999999-FW-000180	SV-49111r1_rule		Low

Description
Denied traffic must be logged. There may also be some instances where a packet that was permitted or other successful event (i.e., logon) should be logged to establish and correlate the series of events leading up to an outage or attack. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured firewall.

Description

Denied traffic must be logged. There may also be some instances where a packet that was permitted or other successful event (i.e., logon) should be logged to establish and correlate the series of events leading up to an outage or attack. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured firewall.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45597r1_chk )
Examine the aggregated firewall application log on the management console. View entries for several alerts. Verify the events being captured in the application logs include the success or failure of the action or request (e.g., login, permission changes) of each event. If the log events do not include the success or failure of the action or request (e.g., login, permission changes), this is a finding.

Check Text ( C-45597r1_chk )

Examine the aggregated firewall application log on the management console.
View entries for several alerts.
Verify the events being captured in the application logs include the success or failure of the action or request (e.g., login, permission changes) of each event.

If the log events do not include the success or failure of the action or request (e.g., login, permission changes), this is a finding.

Fix Text (F-42275r1_fix)
Configure the firewall implementation log so entries in the logs include the success or failure of the action or request (e.g., login, permission changes).