Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-234090	TANS-SV-000018	SV-234090r612749_rule		Medium

Description
In customer environments using the Tanium Zone Server, a Tanium Client may be configured to point to a Zone Server instead of a Tanium Server. The communication requirements for these Clients are identical to the Server-to-Client requirements. https://docs.tanium.com/platform_install/platform_install/reference_network_ports.html

STIG	Date
Tanium 7.3 Security Technical Implementation Guide	2021-12-20

Details

Check Text ( C-37275r610770_chk )
Note: If a Zone Server is not being used, this is Not Applicable. Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Zone Server. Access the host-based firewall configuration on the Tanium Zone Server. Validate a rule exists for the following: Port Needed: Tanium Clients to Zone Server over TCP port 17472. If a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, from Tanium Clients to the Tanium Zone Server, this is a finding.

Check Text ( C-37275r610770_chk )

Note: If a Zone Server is not being used, this is Not Applicable.

Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Zone Server.

Access the host-based firewall configuration on the Tanium Zone Server.

Validate a rule exists for the following:

Port Needed: Tanium Clients to Zone Server over TCP port 17472.

If a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, from Tanium Clients to the Tanium Zone Server, this is a finding.

Fix Text (F-37240r610771_fix)
Configure host-based firewall rules as required, to include Tanium Clients to Zone Server over TCP port 17472.