JUSX-AG-000037 - The Juniper SRX Services Gateway Firewall must generate audit records when unsuccessful attempts to access security zones occur.

Information

Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.

Access for different security levels maintains separation between resources (particularly stored data) of different security domains.

The Juniper SRX Firewall implements security zones which are configured with different security policies based on risk and trust levels.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Include the log and/or syslog action in all zone configurations to log attempts to access zones. To get traffic logs from permitted sessions, add 'then log session-close' to the policy. To get traffic logs from denied sessions, add 'then log session-init' to the policy.

set security policies from-zone <zone_name> to-zone <zone_name> policy <policy_name> then log

Example:
set security policies from-zone untrust to-zone trust policy default-deny then log

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_SRX_SG_Y24M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-214520r557389_rule, STIG-ID|JUSX-AG-000037, STIG-Legacy|SV-80795, STIG-Legacy|V-66305, Vuln-ID|V-214520

Plugin: Juniper

Control ID: 290569ee1ccdea89a1f4cf8271d3ffdf2f33fb31a317c9592a7670a1882d27dd