3.4.2.4 Ensure network interfaces are assigned to appropriate zone

Information

firewall zones define the trust level of network connections or interfaces.

A network interface not assigned to the appropriate zone can allow unexpected or undesired network traffic to be accepted on the interface.

Solution

Run the following command to assign an interface to the approprate zone.

# firewall-cmd --zone=<Zone NAME> --change-interface=<INTERFACE NAME>

Example:

# firewall-cmd --zone=customezone --change-interface=eth0

Impact:

Changing firewall settings while connected over network can result in being locked out of the system.

See Also

https://workbench.cisecurity.org/benchmarks/15962

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: c7c885b7cedff9c9d7faf429102a7a89462df5ea27842df88d964b0661845c97