STIGQter STIGQter: STIG Summary: Forescout Network Access Control Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

Forescout must be configured so client machines do not communicate with other network devices in the DMZ or subnet except as needed to perform a client assessment or to identify itself.

DISA Rule

SV-233319r611394_rule

Vulnerability Number

V-233319

Group Title

SRG-NET-000015-NAC-000130

Rule Version

FORE-NC-000110

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure Forescout to prevent communication with other hosts in the DMZ that do not perform security policy assessment or remediation services.

1. Log on to the Forescout UI.
2. Select Tools >> Options >> Appliance >> IP Assignment.
3. Select Segment >> IP Addresses. Find the IP address for the DMZ subnet and delete it.

Check Contents

1. Select Tools >> Options >> Appliance >> IP Assignment.
2. Select Segment >> IP Addresses.
3. Verify the IP address for the DMZ subnet is not present.

If Forescout is not configured so the devices and servers in the Forescout solution (e.g., NAC, assessment server, policy decision point) do not communicate with other network devices in the DMZ or subnet except as needed to perform a remote access client assessment or to identify itself, this is a finding.

Vulnerability Number

V-233319

Documentable

False

Rule Version

FORE-NC-000110

Severity Override Guidance

1. Select Tools >> Options >> Appliance >> IP Assignment.
2. Select Segment >> IP Addresses.
3. Verify the IP address for the DMZ subnet is not present.

If Forescout is not configured so the devices and servers in the Forescout solution (e.g., NAC, assessment server, policy decision point) do not communicate with other network devices in the DMZ or subnet except as needed to perform a remote access client assessment or to identify itself, this is a finding.

Check Content Reference

M

Target Key

5250

Comments