Title

The system must employ a local firewall. (Cat II impact)

Discussion

A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.

Check Content

Determine the zone that you are currently securing. # zonename If the command output is "global", only the "phys" and "SR-IOV" interfaces assigned to the global zone require inspection. If using a non-Global zone, all "phys" and "SR-IOV" interfaces assigned to the zone require inspection. Determine if the system is using a local firewall. # svcs network/ipfilter If the service is not online, this is a finding.

Fix Text

Enable the system's local firewall. # svcadm enable network/ipfilter

Additional Identifiers

Rule ID: SV-227980r603266_rule

Vulnerability ID: V-227980

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.