Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · NetworkFirewall

NetworkFirewall.5: Default stateless action (fragmented)

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub NetworkFirewall.5 check?

NetworkFirewall.5 checks a firewall policy's StatelessFragmentDefaultActions, the default applied to fragmented packets the stateless engine does not match. It passes when that default is aws:drop or aws:forward_to_sfe and fails when it is aws:pass.

Why does NetworkFirewall.5 matter?

Packet fragmentation is a long-standing evasion technique: an attacker splits a payload across fragments so filters that only inspect the first fragment never see the malicious content, and the target reassembles it. This default governs fragmented UDP packets specifically (Network Firewall only manages UDP fragments here and silently drops fragments of other protocols regardless of the setting). A pass default on UDP fragments is precisely the condition that makes this work against your network: a quiet hole in an otherwise tight policy.

How do I fix NetworkFirewall.5?

  1. Set the policy's fragmented-packet default action to aws:forward_to_sfe so fragments are inspected by the stateful engine.
  2. Use aws:drop if fragmented traffic has no legitimate role in your network.
  3. Re-check after editing; the control is change-triggered and re-evaluates on every policy edit.

Remediation script · bash

# Attach the AWS Managed Rules common baseline to an empty web ACL, in Count mode.
# update-web-acl REPLACES the entire Rules array, so supply the full desired set and the current LockToken.
aws wafv2 update-web-acl \
  --scope REGIONAL --name public-alb-waf --id a1b2c3d4-0000-1111-2222-3333 \
  --lock-token e4f5g6h7 --default-action Allow={} \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=public-alb-waf \
  --rules '[{"Name":"AWS-CommonRuleSet","Priority":0,"Statement":{"ManagedRuleGroupStatement":{"VendorName":"AWS","Name":"AWSManagedRulesCommonRuleSet"}},"OverrideAction":{"Count":{}},"VisibilityConfig":{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"AWS-CommonRuleSet"}}]'

# Associate a baseline web ACL with an unprotected API Gateway stage (the resource ARN is the stage, not the API).
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:111122223333:regional/webacl/prod-api-baseline/1a2b3c4d \
  --resource-arn arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4e5/stages/prod

# Protect a Network Firewall from accidental deletion.
aws network-firewall update-firewall-delete-protection \
  --firewall-name prod-egress-inspection --delete-protection

Full walkthrough (console steps, edge cases and verification) in the lesson Protect APIs and edge with WAF.

Is NetworkFirewall.5 a false positive?

People tune the full-packet default (NetworkFirewall.4) carefully and leave the fragment default at pass because fragments feel like an edge case. The two defaults are independent and both must be non-pass.

Full lesson Protect APIs and edge with WAF Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for NetworkFirewall controls ↗ Check your own account for NetworkFirewall.5 →
Part of the learning path Lock down access

More NetworkFirewall controls