What changed in VMware NSX-T Tier 1 Gateway Firewall STIG V1R3V1R3 changes

VMware NSX-T Tier 1 Gateway Firewall STIG V1R3 (2023-07-26) replaced V1R2 (2022-09-02): 1 check removed, 3 updated. It has 9 checks, against 10 in V1R2.

V1R3 checklistV1R2 checklist Compare V1R2 and V1R3 in STIG Compare

  • 0 added
  • 1 removed
  • 3 updated

Updated fields: Check text 3Fix text 2Discussion 2Title 1

Removed since V1R2 (1)

  • V-251760CAT IThe NSX-T Tier-1 Gateway Firewall must not have any unpublished firewall policies or rules.

Updated in V1R3 (3)

V-251762CAT IIIThe NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.Title, Check text, Fix text, Discussion

Title

The NSX-T DTisteribu-1 Gatedway Firewall must generate traffic log entries containing information to establish the details of the event.

Check text

From the NSX-T Manager web interface, go to Security >> Gateway Firewall >> Gateway Specific Rules. For each Tier-1 Gateway and for each rule, click the gear icon and verify the Logging setting is enabled and set to "Info Level". If Logging is not "Enabled and set to "Info Level", this is a finding.

Fix text

From the NSX-T Manager web interface, go to Security >> Gateway Firewall >> Gateway Specific Rules. For each Tier-1 Gateway and for each rule with logging disabled, click the gear icon and enable Logging, set level to "Info", and then click "Apply". After all changes are made, click "Publish".

Discussion

Without sufficient information to analyze the event, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit event content that must be included to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. The NSX-Tfirewall Distributed Firewall must also generate traffic log records when traffic is denied, restricted, or discarded as well as when attempts are made to send packets between security zones that are not authorized to communicate. Satisfies: SRG-NET-000075-FW-000010, SRG-NET-000076-FW-000011, SRG-NET-000077-FW-000012, SRG-NET-000078-FW-000013, SRG-NET-000399-FW-000008, SRG-NET-000492-FW-000006, SRG-NET-000493-FW-000007

V-251762 in V1R3

V-251763CAT IIEach NSX-T Edge Node configured to host a Tier-1 Gateway Firewall must be configured to use the TLS or LI-TLS protocols to configure and secure traffic log records.Check text, Discussion

Check text

From an NSX-T Edge Node shell hosting the Tier-1 Gateway, run the following command(s): > get logging-servers If any configured logging-servers are not configured with protocol of "li-tls" or "tls" and level of "info", this is a finding. If no logging-servers are not configured to use "li-tls" or "tls", this is a finding. Note: This check must be run from each NSX-T Edge Node hosting the Tier-1 Gateway, as they are configured individually.

Discussion

It is critical that when the network element is at risk of failing to process traffic logs as required, it takes action to mitigate the failure, secure collected log data, and restrict access to authorized personnel. Methods of protection may include encryption or logical separation. In accordance with DoDDOD policy, the traffic log must be sent to a central audit server. This does not apply to traffic logs generated on behalf of the device itself (management). Some devices store traffic logs separately from the system logs. Satisfies: SRG-NET-000089-FW-000019, SRG-NET-000098-FW-000021

V-251763 in V1R3

V-251764CAT IIThe NSX-T Tier-1 Gateway Firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.Check text, Fix text

Check text

From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection to view Flood Protection profiles. If there are no Flood Protection profiles of type "Gateway", this is a finding. For each gateway flood protection profile, verify the TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "not setNone". If orthey SYNare Cache and RST Spoofing is not Enabled on a profile. If not, this is a finding. For each gateway flood protection profile, examine the "Applied To" field to view the Tier-1 Gateways to which it is applied to. If a gateway flood protection profile is not applied to all Tier-1 Gateways through one or more policies, this is a finding.

Fix text

To create a new Flood Protection profile, do the following: From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection >> Add Profile >> Add Firewall Profile. Enter a name and specify appropriate values for the following: TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit. EnableConfigure SYN Cache and RST Spoofing, then configure the "Applied To" field to contain Tier-1 Gateways and then click "Save".

V-251764 in V1R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.