Home
Security Hardening
DISA F5 Big IP Local Traffic Manager 11.x STIG V2R1

DISA F5 Big IP Local Traffic Manager 11.x STIG V2R1

F5BI-LT-000069 – The BIG-IP Core implementation must be configured to remove or disable any functions, ports, protocols, and/or services that are not documented as required.
Details Unrelated or unneeded proxy services increase the attack vector and add excessive complexity to the securing of the ALG....
F5BI-LT-000071 – The BIG-IP Core implementation must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocol, and Service Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.
Details In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data...
F5BI-LT-000073 – The BIG-IP Core implementation must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.
Details To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and...
F5BI-LT-000029 – The BIG-IP Core implementation must be configured to limit the number of concurrent sessions to an organization-defined number for virtual servers – Connection Limit
Details Network element management includes the ability to control the number of users and user sessions that utilize a network...
F5BI-LT-000075 – The BIG-IP Core implementation must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or authentication, authorization, and accounting (AAA) server) that validate user account access authorizations and privileges when providing access control to virtual servers.
Details User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges....
F5BI-LT-000029 – The BIG-IP Core implementation must be configured to limit the number of concurrent sessions to an organization-defined number for virtual servers – Connection Limit Rate
Details Network element management includes the ability to control the number of users and user sessions that utilize a network...
F5BI-LT-000077 – The BIG-IP Core implementation providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s) when providing access control to virtual servers.
Details User authentication can be used as part of the policy filtering rule sets. Some URLs or network resources can...
F5BI-LT-000031 – The BIG-IP Core implementation must be configured to monitor inbound traffic for remote access policy compliance when accepting connections to virtual servers.
Details Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote...
F5BI-LT-000079 – The BIG-IP Core implementation providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts when granting access to virtual servers.
Details To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
F5BI-LT-000033 – The BIG-IP Core implementation must be configured to use encryption services that implement NIST SP 800-52 Revision 2 compliant cryptography to protect the confidentiality of connections to virtual servers.
Details Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access...

Prev Next

DISA F5 Big IP Local Traffic Manager 11.x STIG V2R1

F5BI-LT-000069 – The BIG-IP Core implementation must be configured to remove or disable any functions, ports, protocols, and/or services that are not documented as required.

F5BI-LT-000071 – The BIG-IP Core implementation must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocol, and Service Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

F5BI-LT-000073 – The BIG-IP Core implementation must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) when connecting to virtual servers.

F5BI-LT-000029 – The BIG-IP Core implementation must be configured to limit the number of concurrent sessions to an organization-defined number for virtual servers – Connection Limit

F5BI-LT-000029 – The BIG-IP Core implementation must be configured to limit the number of concurrent sessions to an organization-defined number for virtual servers – Connection Limit Rate

F5BI-LT-000077 – The BIG-IP Core implementation providing user authentication intermediary services must restrict user authentication traffic to specific authentication server(s) when providing access control to virtual servers.

F5BI-LT-000031 – The BIG-IP Core implementation must be configured to monitor inbound traffic for remote access policy compliance when accepting connections to virtual servers.

F5BI-LT-000079 – The BIG-IP Core implementation providing user authentication intermediary services must use multifactor authentication for network access to non-privileged accounts when granting access to virtual servers.

F5BI-LT-000033 – The BIG-IP Core implementation must be configured to use encryption services that implement NIST SP 800-52 Revision 2 compliant cryptography to protect the confidentiality of connections to virtual servers.