Title

When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally. (Cat II impact)

Discussion

If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis. Because of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives. This requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).

Check Content

Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally. If the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.

Fix Text

Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.

Additional Identifiers

Rule ID: SV-207236r856708_rule

Vulnerability ID: V-207236

Group Title: SRG-NET-000336

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.