All checks
Medium
The default stateless action for Network Firewall policies should be drop or forward for fragmented packets
Verifies that the default stateless action for fragmented packets in Network Firewall policies is drop or forward, not pass.
- service
- NetworkFirewall
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Set the default stateless action for fragmented packets to 'aws:drop' or 'aws:forward_to_sfe'.
- Navigate to the VPC console
- Select the Network Firewall policy
- Modify the 'Default stateless actions' for fragmented packets
- Set to 'aws:drop' or 'aws:forward_to_sfe'
- Apply the changes
See which of your accounts this check is failing on.
Book a demo