Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The FortiGate firewall must use filters that use packet headers and packet attributes, including source and destination IP addresses and ports.
Description
Discussion Text
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. Blocking or restricting detected harmful or suspicious communications between interconnected networks enforces approved authorizations for controlling the flow of traffic.
The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers.
Configure filters to perform certain actions when packets match specified attributes, including the following actions:
- Apply a policy
- Accept, reject, or discard the packets
- Classify the packets based on their source address
- Evaluate the next term in the filter
- Increment a packet counter
- Set the packets’ loss priority
- Specify an IPsec SA (if IPsec is used in the implementation)
- Specify the forwarding path
- Write an alert or message to the system log.
The firewall that filters traffic outbound to interconnected networks with different security policies must be configured with filters (i.e., rules, access control lists [ACLs], screens, and policies) that permit, restrict, or block traffic based on organization-defined traffic authorizations. Filtering must include packet header and packet attribute information, such as IP addresses and port numbers.
Configure filters to perform certain actions when packets match specified attributes, including the following actions:
- Apply a policy
- Accept, reject, or discard the packets
- Classify the packets based on their source address
- Evaluate the next term in the filter
- Increment a packet counter
- Set the packets’ loss priority
- Specify an IPsec SA (if IPsec is used in the implementation)
- Specify the forwarding path
- Write an alert or message to the system log.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.