The firewall must establish ingress filters that block inbound packets where the destination is an IP address assigned to the management or loopback addresses of the enclave protection devices unless the packet has a source address assigned to the management network or network infrastructure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79473	SRG-NET-000364-FW-000033	SV-94179r2_rule		Medium

Description
The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The network loopback address or management IP addresses should never be used as the source IP address of an inbound or outbound transmission since it is most likely a spoofing attempt ll traffic with a destination of a management address or to a loopback address for a network protection device should be blocked unless the source is from an authorized management range. The rule or filter should be applied to traffic ingressing on the external interfaces and ingressing onto internal interfaces. It is a best practice for the management network to use the network loopback addresses.

Description

The firewall must reject requests for access or services where the source address received by the firewall specifies a loopback address. The network loopback address or management IP addresses should never be used as the source IP address of an inbound or outbound transmission since it is most likely a spoofing attempt ll traffic with a destination of a management address or to a loopback address for a network protection device should be blocked unless the source is from an authorized management range. The rule or filter should be applied to traffic ingressing on the external interfaces and ingressing onto internal interfaces. It is a best practice for the management network to use the network loopback addresses.

STIG	Date
Firewall Security Requirements Guide	2019-06-28

Details

Check Text ( C-79089r2_chk )
Review the firewall ingress rules/filters for each inbound interface on the perimeter or internal firewall. Verify rules or filters are in place that: - Permits the authorized management network to access the management network or loopback interface addresses on enclave perimeter network devices - Denies any other network from accessing the management network or loopback interface addresses on enclave perimeter network devices If filters do not exist that deny inbound packets where the destination is an IP address assigned to the management or network loopback addresses of the enclave protection devices and permits the packet if it has a source address assigned to the management network or network infrastructure, this is a finding.

Check Text ( C-79089r2_chk )

Review the firewall ingress rules/filters for each inbound interface on the perimeter or internal firewall. Verify rules or filters are in place that:

- Permits the authorized management network to access the management network or loopback interface addresses on enclave perimeter network devices

- Denies any other network from accessing the management network or loopback interface addresses on enclave perimeter network devices

If filters do not exist that deny inbound packets where the destination is an IP address assigned to the management or network loopback addresses of the enclave protection devices and permits the packet if it has a source address assigned to the management network or network infrastructure, this is a finding.

Fix Text (F-86245r2_fix)
Establish ingress filters on both perimeter and internal firewalls to deny inbound packets where the destination is an IP address assigned to the management or network loopback addresses of the enclave protection devices and permits the packet if it has a source address assigned to the management network or network infrastructure. Apply this rule inbound on firewall interfaces.