When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207236	SRG-NET-000336-VPN-001280	SV-207236r561344_rule		Medium

Description
If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis. Because of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives. This requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).

Description

If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis. Because of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives. This requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).

STIG	Date
Virtual Private Network (VPN) Security Requirements Guide	2020-10-02

Details

Check Text ( C-7496r378329_chk )
Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally. If the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.

Fix Text (F-7496r378330_fix)
Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.