The VPN Gateway must produce log records containing information to establish the outcome of the events.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-207200
SRG-NET-000091-VPN-000350
SV-207200r608988_rule
Medium
Description
Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.
Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.
Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.
If the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.
Fix Text (F-7460r378222_fix)
Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.