17.1 Firewall Configuration – Requirement 1

Select Reports > Portal > Repository > Standard Content > PCI > PCI Reports > Requirement 1:Firewall Configuration.

PCI Requirement 1 requires that you install and maintain a firewall configuration to protect card holder data. Firewalls control computer traffic in and out of your network, as well as to and from sensitive areas within secure or sensitive internal networks. To prove compliance with PCI DSS, you must monitor the firewalls at Internet connections and between any demilitarized zones (DMZs). You must also monitor the devices that manage traffic.

Accessed Ports Through Firewall: Reports the firewalls that allowed the most traffic by port number. The table provides results by IP addresses for the firewall, the source system, and the destination system; the destination port; number of events; and the firewall rule number that triggered the event.
Blocked Inbound Traffic to Card Holder Data Environment: Reports the destination ports with inbound traffic that has been blocked the most often. The table provides results by IP addresses for the firewall, the source system, and the destination system; the destination port; the protocol used, number of events; and date of the most recent event.
Blocked Outbound Traffic from Card Holder Data Environment: Reports an overview of blocked outbound traffic over time. The table provides results by blocked outbound traffic per firewall. It lists the IP addresses for the firewall, the source system, and the destination system; the source and destination zones; affected port; and date of the most recent event.
External to Internal PCI Systems: Reports the external systems that are communicating directly with PCI internal systems most often. The table provides results by the IP addresses and zones of the source and destination systems, the affected port, protocol used, and the number of events. PCI standards expects that your enterprise can justify this type of traffic.
Firewall Configuration Changes: Reports the firewalls and devices where the configuration has changed. The table provides results by the IP address, product, and vendor of the device that was changed; the name and rule related to the change; the number of changes detected; and the date of the most recent event.
Inbound Traffic to the Card Holder Data Environment: Reports the five systems that allowed the most inbound traffic by destination address and port. The table provides results by the IP addresses for the firewall, the source system, and the destination system; the affected port; the protocol used; number of events; and date of the most recent event.
Outbound Traffic from the Card Holder Data Environment: Reports the systems that allowed outbound traffic by destination IP address. The table provides results by the IP addresses for the device, the source system, and the destination system; the affected port; the protocol used; number of events; and date of the most recent event.
Unauthorized Inbound Traffic to DMZ: Reports the systems with the highest amount of unauthorized inbound traffic. The table provides results by the IP addresses for the device, the source system, and the destination system; the source zone; affected port; number of events; and date of the most recent event.
Unauthorized Outbound Traffic From Card Holder Data Environment: Reports the ports with the most unauthorized traffic. The table provides results by the IP addresses for the device, the source system, and the destination system; the destination zone; the affected port; the protocol used; and number of events.