The BIG-IP Core implementation must be configured to implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks to virtual servers.

From F5 BIG-IP Local Traffic Manager 11.x Security Technical Implementation Guide

Part of SRG-NET-000362-ALG-000120

Associated with: CCI-002385

SV-74793r1_rule The BIG-IP Core implementation must be configured to implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks to virtual servers.

Vulnerability discussion

If the network does not provide safeguards against DoS attacks, network resources will be unavailable to users. Load balancing provides service redundancy; which service redundancy reduces the susceptibility of the ALG to many DoS attacks.The ALG must be configured to prevent or mitigate the impact on network availability and traffic flow of DoS attacks that have occurred or are ongoing.This requirement applies to the functionality of the device as it pertains to handling network traffic. Some types of attacks may be specialized to certain network technologies, functions, or services. For each technology, known and potential DoS attacks must be identified and solutions for each type implemented.

Check content

Verify the BIG-IP Core implements load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks. Navigate to the BIG-IP System manager >> System >> Configuration >> Local Traffic >> General. Verify "Reaper High-water Mark" is set to 95 and "Reaper Low-water Mark" is set to 85. If the device does not implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks, this is a finding.

Fix text

Configure the BIG-IP Core to implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks. Navigate to the BIG-IP System manager >> System >> Configuration >> Local Traffic >> General. Make the following configurations under "Properties". Set "Reaper High-water Mark" to 95. Set "Reaper Low-water Mark" to 85.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer