The firewall must generate traffic log records when traffic is denied, restricted, or discarded.

From Firewall Security Requirements Guide

Associated with: CCI-000172

SV-94135r1_rule The firewall must generate traffic log records when traffic is denied, restricted, or discarded.

Vulnerability discussion

Without generating log records that log usage of objects by subjects and other objects, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.Security objects are data objects that are controlled by security policy and bound to security attributes.The firewall must not forward traffic unless it is explicitly permitted via security policy. Logging for firewall security-related sources such as screens and security policies must be configured separately. To ensure security objects such as firewall filters (i.e., rules, access control lists [ACLs], screens, and policies) send events to a syslog server and local logs, security logging must be configured one each firewall term.

Check content

View the configuration of the firewall or the central audit server log records. Verify the firewall generates traffic log records when traffic is denied, restricted, or discarded. If the firewall does not generate traffic log records for events when traffic is denied, restricted, or discarded, this is a finding.

Fix text

Configure the firewall central audit server stanza to generate traffic log records for events when traffic is denied, restricted, or discarded.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.