The firewall implementation must be configured to stop generating application log records or overwrite the oldest log records when a log failure occurs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37357	SRG-NET-999999-FW-000187	SV-49118r1_rule		Medium

Description
Firewall implementation logging is a key component of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured firewall. To preserve recent log information, if an audit failure occurs, the firewall must either stop producing audit records to overwrite or purge the oldest records.

Description

Firewall implementation logging is a key component of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured firewall. To preserve recent log information, if an audit failure occurs, the firewall must either stop producing audit records to overwrite or purge the oldest records.

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45604r1_chk )
Verify the firewall is set to either stop generating log records or overwrite the oldest log records when a log failure occurs. If the firewall implementation is not configured to either stop generating log records or overwrite the oldest log records when a log failure occurs, this is a finding.

Fix Text (F-42282r1_fix)
Configure the firewall implementation to either stop generating log records or overwrite the oldest log records when a log failure occurs.