The firewall must implement load balancing on the perimeter firewall to limit the effects of known and unknown types of denial-of-service (DoS) attacks on the network.

From Firewall Security Requirements Guide Requirements

Part of SRG-NET-000362-FW-000159

Associated with: CCI-002385

SRG-NET-000362-FW-000159_rule The firewall must implement load balancing on the perimeter firewall to limit the effects of known and unknown types of denial-of-service (DoS) attacks on the network.

Vulnerability discussion

As a critical security system, perimeter firewalls must be safeguarded with redundancy measures. If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Load balancing provides service redundancy, which reduces the susceptibility of the firewall to many DoS attacks.A firewall experiencing a DoS attack will not be able to handle the traffic load. The high CPU utilization caused by a DoS attack will also have impact control keep-alives and timers used for neighbor peering, resulting in route flapping and eventually black hole traffic.Though redundant hardware is the primary means of compliance, there are a number of ways to meet this requirement. The firewall can also be configured for filter-based forwarding, per-flow load balancing, and/or per-packet load balancing.

Check content

Since load balancing is a highly complex configuration that can be implemented using a wide variety of configurations, ask the site representative to demonstrate the method used and the configuration. If load balancing is not implemented on the perimeter firewall, this is a finding.

Fix text

Consult vendor configuration guides and knowledge base. Implement one or more methods of load balancing (e.g., filter-based forwarding, per-flow load balancing, per-packet load balancing, or hardware redundancy options).

Pro Tips

Powered by sagemincer