What changed in Infoblox 8.x DNS STIG V1R4V1R4 changes

Discussion

External Authoritative DNS service members should *only* be providing External Authoritative and no other "DNS Service". Internal Authoritative servers commonly require that recursion is enabled in order to resolve DNS that is located on a different server (whether it's via forwarding, the Internet, STUB'ing, etc.) A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to nonexistent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate to obtain sensitive data or passwords. To guard against poisoning, name servers authoritative for .mil domains must be separated functionally from name servers that resolve queries on behalf of internal clients. Organizations may achieve this separation by dedicating machines to each function or, if possible, by running split DNS: internal name server and external name server. The use of DNSSEC ensures the answer received when querying for name resolution actually comes from a trusted name server. Since DNSSEC is still far from being globally deployed external to DODDoW, and many resolvers either have not been updated or do not support DNSSEC, maintaining cached zone data separate from authoritative zone data mitigates the gap until all DNS data is validated with DNSSEC. Since DNS forwarding of queries can be accomplished in some DNS applications without caching locally, DNS forwarding is the method to be use when providing external DNS resolution to internal clients.

V-233860 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode, click on the "DNSSEC" tab, and review the "Signature Validity" setting. 3. Validate that the Signature Validity is configured for a range of no less than two days and no more than one week. 4. When complete, click "Cancel" to exit the "Properties" screen. If the "Signature Validity" period is less than two days or greater than one week, this is a finding.

V-233861 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Review the zone configuration and confirm that, if DNSSEC is enabled NSEC3 is used. 2. Navigate to Data Management >> DNS >> Grid DNS Properties. Toggle Advanced Mode and review the "DNSSEC" tab. 3. Ensure "Resource Record Type for Nonexistent Proof" is set to NSEC3. 4. When complete, click "Cancel" to exit the "Properties" screen. 5. Review zone data or use Global Search string ".". Type 6. Enter "Equals NSEC Record" to verify no undesired NSEC records exist. If NSEC records exist in an active zone, or NSEC3 is not configured, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS Properties. 2. Toggle Advanced Mode and editselect the "DNSSEC" tab. 3. Ensure "Resource Record Type for Nonexistent Proof" is set to NSEC3. 4. Re-sign all DNSSEC zones that previously used NSEC.

V-233862 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Validate that DNSSEC is enabled using the check box. 4. When complete, click "Cancel" to exit the "Properties" screen. If "Enable DNSSEC" is not configured, this is a finding.

V-233866 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. For Infoblox Grids that run in FIPS mode, this requirement is Not Applicable. 1. Review FIPS requirements to ensure the proper algorithms are used. 2. Navigate to Data Management >> DNS >> Grid DNS properties. 3. Toggle Advanced Mode and click on the "DNSSEC" tab. 4. Validate that all Key Signing Keys (KSKs) and ZSKs use FIPS-approved algorithms. 5. When complete, click "Cancel" to exit the "Properties" screen. If FIPS-approved algorithms are not used for the KSKs and ZSKs, this is a finding. If DSA is used, this is a finding.

V-233867 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. By default, KSK and ZSK private keys are stored on the Grid Master within the Infoblox database. No clients should be permitted to use the Grid Master DNS service. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone and clicking "Edit" and selecting the "DNSName Servers" tab. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding. If a Hardware Security Module (HSM) is configured, KSK and ZSK private keys are encrypted and stored on the HSM, this is not a finding.

V-233879 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Grid >> Grid Manager >> Members tab. 2. Review the Grid Master network configuration and verify placement on an OOB network. 3. Review services enabled on the Grid Master and verify that no client services are enabled. 4. The only acceptable service allowed is DNS when the Grid uses DNSSEC signed zones. The Grid Master must have DNS enabled to sign DNSSEC zones. If DNSSEC is enabled, verify that the Grid Master is marked as "Stealth" for any zone. If an Infoblox Grid Member does not use the MGMT port for configuration through an OOB connection, this is a finding.

V-233882 in V1R4

Title

Infoblox systems must enforce current DoDW password restrictions.

Check text

1. Navigate to Administration >> Administrators >> Authentication Policy. 2. If the only authentication type under "Authenticate users in this order" is "Local User Database", perform the following additional validation: 3. Navigate to Grid >> Grid Manager >> Grid Properties, or System >> System Manager >> System Properties, if using a stand-alone configuration. 4. Select the "Password" tab. 5. Verify the settings are configured in accordance with current DoDDoW Policy. If the Infoblox system is configured to use a remote authentication system (Active Directory, RADIUS, TACACS+, or LDAP) that enforces password policy, or the password settings meet current guidance, this is not a finding.

Discussion

The Infoblox systems must be configured to meet current DoDW password policy when using the Infoblox Local User Database as the authentication source.

V-233883 in V1R4

Title

The Infoblox system must display the approved DoDW notice and consent banner.

Check text

Navigation to the HTTPS interface on the Grid Master using a web browser will display the current DoDDoW banner. 1. If an administrator is currently logged in, click on the drop-down menu adjacent to the administrator's name in the upper right side and select "Logout". 2. Open a new session to the Infoblox system and review the banner presented. 3. The banner text of the document MUST read: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the correct banner is not displayed, this is a finding.

Discussion

Configuration of the DoDW notice and consent banner requires all administrators to acknowledge the current DoDW notice and consent by clicking an "Accept" button.

V-233885 in V1R4

Fix text

1. Navigate to Grid >> Grid Manager >> Grid Properties, or System >> System Manager >> System Properties if using a stand-alone configuration. 2. Select the "Security", "Advanced" tab. Click "Enable Security Banner". 3. Use the drop-down menus to select the Security Level and Security Level Color appropriate for each level. 4. Additional text can be entered if required by DoDDoW or local policy. 5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 6. Administrators should log out and close the web browser. 7. It may be necessary to clear the web browser cache for the banner to display or update on a session opened shortly after reconfiguration.

V-233886 in V1R4

Title

The Infoblox system must be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Discussion

Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements. Configuring the DNS server implementation to follow organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoDDoW that reflects the most restrictive security posture consistent with operational requirements.

V-233887 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. Validate that DNSSEC validation is enabled: 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233889 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. Validate that DNSSEC validation is enabled: 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233890 in V1R4

Check text

Note:Validate Forthat InfobloxDNSSEC DNSvalidation systems on a classified network, this requirement is Not Applicableenabled. 1. ValidateNavigate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233893 in V1R4

Check text

Note:Validate Forthat InfobloxDNSSEC DNSvalidation systems on a classified network, this requirement is Not Applicableenabled. 1. ValidateNavigate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

Discussion

The major threat associated with DNS forged responses or failures is the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. This requirement enables remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service. A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS to map between host/service names and network addresses must provide other means to ensure the authenticity and integrity of response data. In the case of DNS, employ DNSSEC to provide an additional data origin and integrity artifacts along with the authoritative data the system returns in response to DNS name/address resolution queries. DNSSEC is intended for third-party authenticity determination. Attempting to utilize DNSSEC internally was never an intended use case as it would require every consumer to have a third-party validating resolver installed along with a mechanism for periodic trust anchor distribution/update. It is recommended for external zones only.

V-233894 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. By default, all services other than those required for management are disabled. Validate that no additional services have been enabled for DNS members. 1. Navigate to Grid >> Grid Manager >> Grid Properties, or System >> System Manager >> System Properties if using a stand-alone configuration. 2. Select the "Services" tab and review each service and member status at the top of the panel. Depending on purchased options, Infoblox DNS service members may be running DNS and optionally running services supporting DNS and security operations such as DNS Traffic Control, Threat Protection, Threat Analytics, and TAXII services. Use of these additional Infoblox services is not a finding. If any unnecessary services such as file distribution services are enabled on the DNS members, this is a finding. Note: Once DNSSEC is enabled, the DNS service will be required to be running on the Grid Master, and it will be placed into stealth mode.

V-233897 in V1R4

Check text

Note: For an Infoblox DNSGrid systemsthat onis astrictly classifiedutilized networkfor recursive/caching DNS versus Public Authoritative DNS, this requirement is Not Applicable. By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab. 3. When complete, click "Cancel" to exit the "Properties" screen. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

V-233903 in V1R4

Check text

Note: For an Infoblox DNSGrid systemsthat onis astrictly classifiedutilized networkfor Recursive/Caching DNS versus Public Authoritative DNS, this requirement is Not Applicable. By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab. 3. When complete, click "Cancel" to exit the "Properties" screen. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

V-233904 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. Note: For Infoblox Grids that run in FIPS mode, this requirement is Not Applicable. Refer to the Administrator Guide for more information on FIPS Mode. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Validate that all Key Signing Keys (KSKs) and Zone Signing Keys (ZSKs) use FIPS-approved algorithms. 4. When complete, click "Cancel" to exit the "Properties" screen. If non-FIPS-approved algorithms are in use, this is a finding.

Fix text

Note: Ensure DNSSEC is configured to meet all other STIG requirements prior to signing a zone to avoid signing with an unapproved configuration. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Configure FIPS-compliant algorithms. 4. Follow manual key rollover procedures and update all noncompliant KSKs and ZSKs to use FIPS-approved algorithms.

V-233906 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode, click onthe "DNSSEC" tab, and verify that "Enable DNSSEC" is enabled. 3. Navigate to Data Management >> DNS >> Zones. Verify that the "Signed" column is displayed. 4. Validate that all external authoritative zones are signed by displaying "Yes". 5. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC is not enabled and external authoritative zones are not signed, this is a finding.

Discussion

The underlying feature in the major threat associated with DNS query/response (i.e., forged response or response failure) is the integrity of DNS data returned in the response. The security objective is to verify the integrity of each response received. An integral part of integrity verification is to ensure that valid data has originated from the right source. Establishing trust in the source is called data origin authentication. The security objectives, and consequently the security services, that are required for securing the DNS query/response transaction are data origin authentication and data integrity verification. The specification for a digital signature mechanism in the context of the DNS infrastructure is in the Internet Engineering Task Force's (IETF's) Domain Name System Security Extension (DNSSEC) standard. In DNSSEC, trust in the public key (for signature verification) of the source is established not by going to a third party or a chain of third parties (as in public key infrastructure [PKI] chaining), but by starting from a trusted zone (such as the root zone) and establishing the chain of trust down to the current source of response through successive verifications of signature of the public key of a child by its parent. The public key of the trusted zone is called the trust anchor.

V-233907 in V1R4

Check text

Note:Verify Forthat InfobloxDNSSEC DNSvalidation systems on a classified network, this requirement is Not Applicableenabled. 1. VerifyNavigate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233908 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. Infoblox systems within a Grid configuration automatically publish DS records to the parent zone when the child zone is signed. If all External-facing DNS service members for parent and child zones are within an Infoblox Grid, this is not a finding. 1. Review the parent External zones hosted on the External-facing Infoblox server for which the child zone is on the same Infoblox Grid. 2. Verify that each zone includes the DS records for the child zone. If DS records are not published in the parent zone for DNSSEC signed zones, this is a finding.

V-233909 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode, click onthe "DNSSEC" tab, and review the "Signature Validity" setting. 3. Validate that the Signature Validity is configured for a range of no less than two days and no more than one week. 4. When complete, click "Cancel" to exit the "Properties" screen. If the Signature Validity period is less than two days or greater than one week, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode, click onthe "DNSSEC" tab, and edit the "Signature Validity" setting to a period between two days and one week. 3. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 4. Any zones that used an incorrect value should perform a ZSK rollover to update the inception and expiration dates with the new value. 5. Navigate to Data Management >> DNS and select the "Zones" tab. 6. Using the zone selection check boxes and the DNSSEC drop-down menu, select "Rollover Zone-Signing Key". 7. When prompted, select "Roll Over". 8. Perform a service restart if necessary.

V-233910 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. The Authoritative Check applies to external-facing authoritative zones: 1. Navigate to Data Management >> DNS >> Zones. Note: To add "Signed" column, select an existing column >> down arrow >> Columns >> Edit Columns. Set the "Signed" check box to "Visible" and select "Apply". DNSSEC signing status will be displayed in the "Zones" tab. 2. Verify that external authoritative zones are DNSSEC signed. Recursive Check: 1. Navigate to Data Management >> DNS. 2. Edit "Grid DNS Properties", toggle Advanced Mode, and then select the DNSSEC tab. 3. Validate that both "Enable DNSSEC" and "Enable DNSSEC Validation" options are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC is not used for authoritative DNS and enabled for recursive clients, this is a finding.

Fix text

Note: Ensure DNSSEC is configured to meet all other STIG requirements prior to signing a zone to avoid signing with an unapproved configuration. The Authoritative Fix applies to external-facing authoritative zones: Authoritative Fix: 1. Navigate to Data Management >> DNS >> Zones. 2. Select the appropriate zone using the check box. From the "DNSSEC" drop-down menu, select "Sign Zones". 3. Follow prompts to acknowledge zone signing. 4. Perform a service restart if necessary. Recursive Fix: 1. Navigate to Data Management >> DNS >> Zones. 2. Edit "Grid DNS Properties", toggle Advanced Mode, and then select the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC Validation" options. 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233912 in V1R4

Check text

Note:Validate Forthat InfobloxDNSSEC DNSvalidation systems on a classified network, this requirement is Not Applicableenabled. 1. ValidateNavigate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

For Internal Recursive DNS service members resolving internal queries to external DNS sources: 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233913 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Verify that both "Enable DNSSEC" and "Enable DNSSEC validation" are enabled. 4. When complete, click "Cancel" to exit the "Properties" screen. If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Fix text

1. Navigate to Data Management >> DNS >> Grid DNS properties. 2. Toggle Advanced Mode and click on the "DNSSEC" tab. 3. Enable both "Enable DNSSEC" and "Enable DNSSEC validation". 4. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 5. Perform a service restart if necessary.

V-233919 in V1R4

Check text

Note:Verify Forthat InfobloxDNSSEC DNS systems on a classified network, this requirement is Not Applicableenabled. 1. VerifyNavigate that DNSSEC is enabled by navigating to Data Management >> DNS >> Grid DNS properties tab. 2. Toggle Advanced Mode and review the "DNSSEC" tab to verify that DNSSEC is enabled. 3. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC validation is not enabled, this is a finding.

V-233923 in V1R4

Check text

Note:Verify Forthat InfobloxDNSSEC DNS systems on a classified network, this requirement is Not Applicableenabled. 1. VerifyNavigate that DNSSEC is enabled by navigating to Data Management >> DNS >> Grid DNS properties tab. 2. Toggle Advanced Mode and review the "DNSSEC" tab to verify that DNSSEC is enabled. 3. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC validation is not enabled, this is a finding.

V-233924 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Zones. 2. Review all external-facing authoritative zones. Note: To add "Signed" column, select an existing column >> down arrow >> Columns >> Edit Columns. Set the "Signed" check box to "Visible" and select "Apply". DNSSEC signing status will be displayed in the "Zones" tab. 3. Verify that external authoritative zones are DNSSEC signed. If DNSSEC is not used for authoritative DNS, this is a finding.

V-233925 in V1R4

Check text

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. 1. Navigate to Data Management >> DNS >> Zones. 2. Review all external-facing authoritative zones. Note: To add "Signed" column, select an existing column >> down arrow >> Columns >> Edit Columns. Set the "Signed" check box to "Visible" and select "Apply". DNSSEC signing status will be displayed in the Zones tab. Verify that external authoritative zones are DNSSEC signed. If DNSSEC is not used for authoritative DNS this is a finding.

V-233926 in V1R4

Check text

Infoblox systems are capable of providing notifications via remote SYSLOG, SNMP, and SMTP. 1. Navigate to Grid >> Grid Manager >> Grid Properties, or System >> System Manager >> System Properties if using a stand-alone configuration. 2. Select the "Monitoring" tab. 3. Verify that "Log to External Syslog Servers" is enabled and an External Syslog Server is configured. 4. Click "Cancel" to exit the "Properties" screen. 5. Navigate to DNS >> DNS Management and select Grid or System DNS Properties if using a stand-alonestandalone configuration. 6. Toggle Advanced Mode and select the "Logging" tab. Validate that the "dnssec" SYSLOG category is enabled. 7. When complete, click "Cancel" to exit the "Properties" screen. If DNSSEC is not configured to send external notifications to a valid external SYSLOG server, this is a finding.

Fix text

1. Navigate to Grid >> Grid Manager >> Grid Properties, or System >> System Manager >> System Properties if using a stand-alonestandalone configuration. 2. Select the "Monitoring" tab. 3. Enable "Log to External Syslog Servers" using the check box. 4. Configure an "External Syslog Server". 5. Click "Save & Close" to save the changes and exit the "Properties" screen. 6. Navigate to DNS >> DNS Management and select Grid or System DNS Properties if using a stand-alonestandalone configuration. 7. Toggle Advanced Mode and select the "Logging" tab. 8. Enable the "dnssec" SYSLOG category. 9. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 10. Perform a service restart if necessary.

CCIs

CCI-002702CCI-002702,CCI-001294

V-233928 in V1R4