NIST Special Publication 800-41 establishes guidelines for firewalls and firewall policies, which govern standards and best practices for firewall policy management.
According to the guidelines, an organization’s firewall policies should be based on a comprehensive risk-assessment. Firewall policies should be based on blocking all inbound and outbound traffic (“Default Deny”), with exceptions made for desired traffic. Policies should consider the source and destination of the traffic, in addition to the content. Many types of IPv4 traffic, such as those with invalid or private addresses, should be blocked by default. Organizations also should have policies for handling incoming and outgoing IPv6 traffic. Organizations should also determine which applications may send traffic into and out of its network and make firewall policies to block traffic for other applications.
According to the guidelines (5.2.2), “if multiple firewalls need to have the same rules or a common subset of rules, those rules should be synchronized across the firewalls. This is usually done in a vendor-specific fashion.”
AlgoSec provides out-of-the-box regulatory compliance reports for NIST SP 800-41.