What changed in VMware NSX-T Distributed Firewall STIG V1R3V1R3 changes

VMware NSX-T Distributed Firewall STIG V1R3 (2023-07-26) replaced V1R1 (2022-03-30): 1 check removed, 1 updated. It has 7 checks, against 8 in V1R1.

V1R3 checklistV1R1 checklist Compare V1R1 and V1R3 in STIG Compare

  • 0 added
  • 1 removed
  • 1 updated

Updated fields: Check text 1Fix text 1

Removed since V1R1 (1)

  • V-251726CAT IThe NSX-T Distributed Firewall must not have any unpublished firewall policies or rules.

Updated in V1R3 (1)

V-251728CAT IIThe NSX-T Distributed Firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.Check text, Fix text

Check text

From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection to view Flood Protection profiles. If there are no Flood Protection profiles of type "Distributed Firewall", this is a finding. If the TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit are set to "not set" or SYN Cache and RST Spoofing isare not Enabledenabled on a profile, this is a finding. For each distributed firewall flood protection profile, examine the "Applied To" field to view the workloads it is protecting. If a distributed firewall flood protection profile is not applied to all workloads through one or more policies, this is a finding.

Fix text

To create a new Flood Protection profile, do the following: From the NSX-T Manager web interface, go to Security >> SecurityGeneral ProfilesSettings >> Firewall >> Flood Protection >> Add Profile >> Add Firewall Profile. Enter a name and specify appropriate values for the following: TCP Half Open Connection limit, UDP Active Flow Limit, ICMP Active Flow Limit, and Other Active Connection Limit. Enable SYN Cache and RST Spoofing, configure the "Applied To" field with the appropriate security groups, and then click "Save".

V-251728 in V1R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.