The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79473	SRG-NET-000364-FW-000033	SV-94179r2_rule		Medium

Description
The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The network loopback address or management IP addresses should never be used as the source IP address of an inbound or outbound transmission since it is most likely a spoofing attempt ll traffic with a destination of a management address or to a loopback address for a network protection device should be blocked unless the source is from an authorized management range. The rule or filter should be applied to traffic ingressing on the external interfaces and ingressing onto internal interfaces. It is a best practice for the management network to use the network loopback addresses.

Description

The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The network loopback address or management IP addresses should never be used as the source IP address of an inbound or outbound transmission since it is most likely a spoofing attempt ll traffic with a destination of a management address or to a loopback address for a network protection device should be blocked unless the source is from an authorized management range. The rule or filter should be applied to traffic ingressing on the external interfaces and ingressing onto internal interfaces. It is a best practice for the management network to use the network loopback addresses.

STIG	Date
Firewall Security Requirements Guide	2018-12-24

Details

Check Text ( None )
None

Fix Text (None)
None