Title

The Windows Firewall log file name and location must be configured for the Public Profile. (Cat III impact)

Discussion

A firewall provides a line of defense against attack. To be effective, it must be enabled and properly configured. The location and file name of the firewall log for a public network connection will be defined to ensure the logs are maintained.

Check Content

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Windows Firewall Properties (this link will be in the right pane) -> Public Profile Tab -> Logging (select Customize), "Name" to "%windir%\system32\logfiles\firewall\publicfirewall.log". Configure a comparable setting if a third-party firewall is used.

Additional Identifiers

Rule ID: SV-25246r2_rule

Vulnerability ID: V-17444

Group Title: Windows Firewall Public - Log File

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.