The firewall must block or restrict inbound IP packets destined to the control plane of the firewall itself.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79475	SRG-NET-000364-FW-000034	SV-94181r1_rule		Medium

Description
As a critical security system, perimeter firewalls must be safeguarded against direct attacks to the device. The firewall must have a filter that rejects requests for access or services where the source address received by the firewall specifies an external address and the destination address specifies the control plane of the firewall.

STIG	Date
Firewall Security Requirements Guide	2019-06-28

Details

Check Text ( C-79091r1_chk )
Review the device configuration to determine if filters are in place to block loopback addresses. Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure). If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.

Check Text ( C-79091r1_chk )

Review the device configuration to determine if filters are in place to block loopback addresses.

Verify packets with a destination IP address assigned to the management or loopback address range are blocked (unless the packet has a source address assigned to the management network or network infrastructure).

If inbound IP packets destined to the control plane of the firewall itself are not blocked or restricted by an ingress firewall filter, this is a finding.

Fix Text (F-86247r1_fix)
Establish ingress filters to block or restrict inbound IP packets destined to the control plane of the firewall itself.