The Juniper SRX Services Gateway Firewall must generate audit records when unsuccessful attempts to access security zones occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214520	JUSX-AG-000037	SV-214520r557389_rule		Medium

Description
Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The Juniper SRX Firewall implements security zones which are configured with different security policies based on risk and trust levels.

Description

Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Access for different security levels maintains separation between resources (particularly stored data) of different security domains. The Juniper SRX Firewall implements security zones which are configured with different security policies based on risk and trust levels.

STIG	Date
Juniper SRX Services Gateway ALG Security Technical Implementation Guide	2020-09-28

Details

Check Text ( C-15726r297244_chk )
To verify what is logged in the Syslog, view the Syslog server (Syslog server configuration is out of scope for this STIG); however, the reviewer must also verify that packets are being logged to the local log using the following commands. From operational mode, enter the following command. show firewall log View the Action column; the configured action of the term matches the action taken on the packet: A (accept), D (discard). If events in the log do not reflect the action taken on the packet, this is a finding.

Check Text ( C-15726r297244_chk )

To verify what is logged in the Syslog, view the Syslog server (Syslog server configuration is out of scope for this STIG); however, the reviewer must also verify that packets are being logged to the local log using the following commands.

From operational mode, enter the following command.

show firewall log

View the Action column; the configured action of the term matches the action taken on the packet: A (accept), D (discard).

If events in the log do not reflect the action taken on the packet, this is a finding.

Fix Text (F-15724r297245_fix)
Include the log and/or syslog action in all zone configurations to log attempts to access zones. To get traffic logs from permitted sessions, add "then log session-close" to the policy. To get traffic logs from denied sessions, add "then log session-init" to the policy. set security policies from-zone to-zone policy then log Example: set security policies from-zone untrust to-zone trust policy default-deny then log

Fix Text (F-15724r297245_fix)

Include the log and/or syslog action in all zone configurations to log attempts to access zones. To get traffic logs from permitted sessions, add "then log session-close" to the policy. To get traffic logs from denied sessions, add "then log session-init" to the policy.

set security policies from-zone to-zone policy then log

Example:
set security policies from-zone untrust to-zone trust policy default-deny then log