STIGQter: STIG Summary: A10 Networks ADC NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Apr 2016:

The A10 Networks ADC must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.

DISA Rule

SV-82533r1_rule

Vulnerability Number

V-68043

Group Title

SRG-APP-000108-NDM-000232

Rule Version

AADC-NM-000033

Severity

CAT III

CCI(s)

• CCI-000139 - The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.

Weight

10

Fix Recommendation

The following command enables the device to send an SNMP trap when the health monitor shows the connection to the server is down:
snmp-server enable traps slb server-down

The following command enables the device to send an SNMP trap when the health-monitor shows the connection to the server is up:
snmp enable traps slb server-up

The following command creates a health monitor for UDP 514 (the Syslog port):
health monitor [monitor name]
method udp port 514

The following command creates a Server Load Balancing instance and assigns a health monitor to it:
slb server server-name [ipaddr | hostname]
health-check [monitor]

Check Contents

Review the device configuration.

The following command shows the configured Server Load Balancing instances:
show run | sec slb

If no Server Load Balancing instance is configured with a health check to the Syslog server, this is a finding.

The following command shows the device configuration and filters the output on the string "snmp":
show run | inc snmp

This will include which SNMP traps the device is configured to send.

If the output does not include "snmp-server enable traps slb server-down", this is a finding.

Vulnerability Number

V-68043

Documentable

False

Rule Version

AADC-NM-000033

Severity Override Guidance

Review the device configuration.

The following command shows the configured Server Load Balancing instances:
show run | sec slb

If no Server Load Balancing instance is configured with a health check to the Syslog server, this is a finding.

The following command shows the device configuration and filters the output on the string "snmp":
show run | inc snmp

This will include which SNMP traps the device is configured to send.

If the output does not include "snmp-server enable traps slb server-down", this is a finding.

Check Content Reference

M

Target Key

2915

Comments