V1R3 changes
VMware NSX-T Tier-0 Gateway Firewall STIG V1R3 (2023-07-26) replaced V1R2 (2022-09-02): 1 check removed, 2 updated. It has 7 checks, against 8 in V1R2.
V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare
- 0 added
- 1 removed
- 2 updated
Updated fields: Check text 2Fix text 1Discussion 1
Removed since V1R2 (1)
- V-251736CAT IThe NSX-T Tier-0 Gateway Firewall must not have any unpublished firewall policies or rules.
Updated in V1R3 (2)
V-251738CAT IIThe NSX-T Tier-0 Gateway Firewall must be configured to use the TLS or LI-TLS protocols to configure and secure communications with the central audit server.Check text, Discussion
Check text
From an NSX-T Edge Node shell hosting the Tier-10 Gateway, run the following command(s):
> get logging-servers
If any configured logging-servers are not configured with protocol of "li-tls" or "tls" and level of "info", this is a finding.
If primaryno and secondary logging-servers are not configured to use "li-tls" or "tls", this is a finding.
Note: This check must be run from each NSX-T Edge Node hosting the Tier-0 Gateway, as they are configured individually.
Discussion
It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure. Collected log data be secured and access restricted to authorized personnel. Methods of protection may include encryption or logical separation.
In accordance with DoDDOD policy, the traffic log must be sent to a central audit server.
Ensure at least primary and secondary syslog servers are configured on the firewall.
If the product inherently has the ability to store log records locally, the local log must also be secured. However, this requirement is not met since it calls for a use of a central audit server.
This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs.
Satisfies: SRG-NET-000089-FW-000019, SRG-NET-000098-FW-000021, SRG-NET-000333-FW-000014
V-251739CAT IIThe NSX-T Tier-0 Gateway Firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.Check text, Fix text
Check text
If the Tier-0 Gateway is deployed in an Active/Active HA mode and no stateless rules exist, this is Not Applicable.
From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection to view Flood Protection profiles.
If there are no Flood Protection profiles of type "Gateway", this is a finding.
For each gateway flood protection profile, verify the TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "not setNone".
If orthey SYNare Cache and RST Spoofing is not Enabled on a profile, this is a finding.
For each gateway flood protection profile, examine the "Applied To" field to view the Tier-0 Gateways to which it is applied.
If a gateway flood protection profile is not applied to all applicable Tier-0 Gateways through one or more policies, this is a finding.
Fix text
To create a new Flood Protection profile, do the following:
From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection >> Add Profile >> Add FirewallEdge Gateway Profile.
Enter a name and specify appropriate values for the following: TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit.
EnableConfigure SYN Cache and RST Spoofing, configure the "Applied To" field to contain Tier-0 Gateways, and then click "Save".
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.