The IPS must prevent access into the organization's internal networks except as explicitly permitted and controlled by employing boundary protection devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000201-IDPS-000208	SRG-NET-000201-IDPS-000208	SRG-NET-000201-IDPS-000208_rule		Medium

Description
The enclave's internal network contains the servers where mission critical data and applications reside. There should never be connection attempts made to these devices from any host outside of the enclave. The initial defense for the internal network is to block any traffic at the perimeter attempting to make a connection to a host residing on the internal network.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43367_chk )
Inspect the rules installed on the IPS. Verify rules exist to monitor for invalid access into the organization's internal networks. Verify an enforcement action is taken to deny all access for direct connection to the internal network from outside the enclave. If a rule preventing direct access to the internal network from a source external to the DoD enclave does not exist, this is a finding.

Fix Text (F-43367_fix)
Implement rules for monitoring and enforcing a denial-by-default of access traffic from outside the enclave with destination addresses directly to the internal network.