Forescout must be configured so client machines do not communicate with other network devices in the DMZ or subnet except as needed to perform a client assessment or to identify itself. This is required for compliance with C2C Step 2.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-233319 | SRG-NET-000015-NAC-000130 | FORE-NC-000110 | SV-233319r1026162_rule | 2024-12-19 | 2 |
| Description |
|---|
| Devices not compliant with DOD secure configuration policies are vulnerable to attack. While endpoints are undergoing NAC authorization assessment, they must communicate only with the NAC. These devices should not communicate with other hosts in any DMZ or other network segments. |
| ℹ️ Check |
|---|
| If DOD is not at C2C Step 2 or higher, this is not a finding. 1. Select Tools >> Options >> Appliance >> IP Assignment. 2. Select Segment >> IP Addresses. 3. Verify the IP address for the DMZ subnet is not present. If Forescout allows endpoints under assessment to communicate with other endpoints in the DMZ or on other network segments, this is a finding. |
| ✔️ Fix |
|---|
| Configure Forescout to prevent endpoints under assessment from communicating with other hosts in the DMZ or other network segments. 1. Log on to the Forescout UI. 2. Select Tools >> Options >> Appliance >> IP Assignment. 3. Select Segment >> IP Addresses. Find the IP address for the DMZ subnet and delete it. |