Back to Checks
aws

Network Firewall policy drops or forwards fragmented packets by default

networkfirewall_policy_default_action_fragmented_packets
Service: networkfirewallSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsNetworkFirewallFirewall

Network Firewall policies are assessed for the StatelessFragmentDefaultActions setting to confirm fragmented UDP packets use aws:drop or aws:forward_to_sfe.

Prowler logoProwlerprowler-provider-aws

Risk

Using aws:pass for fragmented UDP lets uninspected traffic traverse the firewall. Attackers can evade filters via fragmentation, enabling data exfiltration (confidentiality), payload smuggling and lateral movement (integrity), and fragment floods that strain services (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_policy_default_action_fragmented_packets

Recommendation

Set StatelessFragmentDefaultActions to aws:drop or aws:forward_to_sfe so fragments are blocked or sent for stateful inspection. Apply least privilege on traffic flows, use defense in depth with rule groups, and monitor logs for anomalous fragmentation.

Remediation

Terraform

resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:drop"]
    stateless_fragment_default_actions = ["aws:drop"]  # Critical: drop fragmented UDP packets by default to pass the check
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::FirewallPolicy
    Properties:
      FirewallPolicyName: <example_resource_name>
      FirewallPolicy:
        StatelessDefaultActions:
          - aws:drop
        StatelessFragmentDefaultActions:
          - aws:drop  # Critical: ensures fragmented UDP packets are dropped by default to pass the check

Other

1Open the Amazon VPC console and go to Network Firewall > Firewall policies
2Select the policy to edit and choose Edit
3Under Stateless default actions, find Fragmented packets
4Set the action to Drop (or Forward to stateful rule groups)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_policy_default_action_fragmented_packets(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "FAIL"
            report.status_extended = f"Network Firewall {firewall.name} policy does not drop or forward fragmented packets by default."

            if (
                "aws:drop" in firewall.default_stateless_frag_actions
                or "aws:forward_to_sfe" in firewall.default_stateless_frag_actions
            ):
                report.status = "PASS"
                report.status_extended = f"Network Firewall {firewall.name} policy does drop or forward fragmented packets by default."

            findings.append(report)

        return findings

References