The firewall implementation must be configured to send an alert to designated personnel in the event the application log fails to function.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37356	SRG-NET-999999-FW-000186	SV-49117r1_rule		Medium

Description
Firewall application logging is a key component of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify a firewall that has been configured improperly. It is imperative that the firewall be configured to generate an alarm when an audit failure occurs.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45603r1_chk )
Verify the firewall components are set to send an email or other alert if the log becomes full and new log entries cannot be written. If the firewall implementation is not configured to send an alert to designated personnel in the event of an audit processing failure, this is a finding.

Fix Text (F-42281r1_fix)
Configure the firewall implementation components to send an email or other alert if new log entries cannot be written to the log.