IPSec VPN Gateway Security Technical Implementation Guide

IPSec VPN Gateway Security Technical Implementation Guide

Details

Version / Release: V1R10

Published: 2015-09-21

Updated At: 2018-09-23 05:05:05

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-3000r4_rule NET1020 LOW The network device must log all interface access control lists (ACL) deny statements. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network d
    SV-3012r4_rule NET0230 HIGH Network devices must be password protected. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to
    SV-3013r4_rule NET0340 MEDIUM Network devices must display the DoD-approved logon banner warning. All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized
    SV-3014r4_rule NET1639 MEDIUM The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left
    SV-3020r3_rule NET0820 LOW Network devices must have DNS servers defined if it is configured as a client resolver. The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of t
    SV-3021r3_rule NET0890 MEDIUM Network devices must only allow SNMP access from addresses belonging to the management network. Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assuranc
    SV-3034r3_rule NET0400 MEDIUM Network devices must authenticate all IGP peers. A rogue router could send a fictitious routing update to convince a site's premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site's network, or mere
    SV-3043r4_rule NET1675 MEDIUM The network device must use different SNMP community names or groups for various levels of read and write access. Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking
    SV-3056r7_rule NET0460 HIGH Group accounts must not be configured for use on the network device. Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the
    SV-3057r5_rule NET0465 MEDIUM Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mis
    SV-3058r5_rule NET0470 MEDIUM Unauthorized accounts must not be configured for access to the network device. A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service
    SV-3062r4_rule NET0600 HIGH Network devices must be configured to ensure passwords are not viewable when displaying configuration information. Many attacks on information systems and network devices are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.Information Assura
    SV-3069r5_rule NET1638 MEDIUM Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted
    SV-3070r4_rule NET1640 LOW Network devices must log all attempts to establish a management connection for administrative access. Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. Wit
    SV-3072r3_rule NET1030 LOW The running configuration must be synchronized with the startup configuration after changes have been made and implemented. If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes were security related, then the routers would be vulnerable t
    SV-3078r3_rule NET0720 LOW Network devices must have TCP and UDP small servers disabled. Cisco IOS provides the "small services" that include echo, chargen, and discard. These services, especially their User Datagram Protocol (UDP) versions, are infrequently used for legitimate purposes. However, they have been used to launch denial of servic
    SV-3079r3_rule NET0730 LOW Network devices must have the Finger service disabled. The Finger service supports the UNIX Finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engi
    SV-3080r3_rule NET0760 MEDIUM The Configuration auto-loading feature must be disabled. Devices can find their startup configuration either in their own NVRAM or access it over the network via TFTP or Remote Copy (rcp). Loading the image from the network is taking a security risk since the image could be intercepted by an attacker who could
    SV-3081r3_rule NET0770 MEDIUM IP source routing must be disabled. Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance OfficerECSC-1
    SV-3083r3_rule NET0790 LOW IP directed broadcast must be disabled on all layer 3 interfaces. An IP directed broadcast is a datagram sent to the broadcast address of a subnet that is not directly attached to the sending machine. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it
    SV-3085r3_rule NET0740 MEDIUM Network devices must have HTTP service for administrative access disabled. The additional services that the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent sof
    SV-3086r3_rule NET0750 LOW BOOTP services must be disabled. BOOTP is a user datagram protocol (UDP) that can be used by Cisco routers to access copies of Cisco IOS Software on another Cisco router running the BOOTP service. In this scenario, one Cisco router acts as a Cisco IOS Software server that can download th
    SV-3143r4_rule NET0240 HIGH Network devices must not have any default manufacturer passwords. Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not
    SV-3160r4_rule NET0700 MEDIUM Network devices must be running a current and supported operating system with all IAVMs addressed. Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches
    SV-3175r5_rule NET1636 HIGH The network device must require authentication prior to establishing a management connection for administrative access. Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network ou
    SV-3196r4_rule NET1660 HIGH The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an
    SV-3210r4_rule NET1665 HIGH The network device must not use the default or well-known SNMP community strings public and private. Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device usi
    SV-3966r5_rule NET0440 MEDIUM In the event the authentication server is down or unavailable, there must only be one local account of last resort created for emergency use. Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between t
    SV-3967r4_rule NET1624 MEDIUM The network devices must time out access to the console port at 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminati
    SV-3969r5_rule NET0894 MEDIUM Network devices must only allow SNMP read-only access. Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1
    SV-4582r5_rule NET1623 HIGH The network device must require authentication for console access. Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Inform
    SV-4584r3_rule NET1021 LOW The network device must log all messages except debugging and send all log data to a syslog server. Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network.
    SV-5611r4_rule NET1637 MEDIUM The network devices must only allow management connections for administrative access from hosts residing in the management network. Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and c
    SV-5612r3_rule NET1645 MEDIUM The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for
    SV-5613r4_rule NET1646 MEDIUM The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface. An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance OfficerE
    SV-5614r3_rule NET0722 LOW Network devices must have the PAD service disabled. Packet Assembler Disassembler (PAD) is an X.25 component seldom used. It collects the data transmissions from the terminals and gathers them into a X.25 data stream and vice versa. PAD acts like a multiplexer for the terminals. If enabled, it can rende
    SV-5615r3_rule NET0724 LOW Network devices must have TCP Keep-Alives enabled for TCP sessions. Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormall
    SV-5616r3_rule NET0726 LOW Network devices must have identification support disabled. Identification support allows one to query a TCP port for identification. This feature enables an unsecured protocol to report the identity of a client initiating a TCP connection and a host responding to the connection. Identification support can conne
    SV-5618r3_rule NET0781 MEDIUM Gratuitous ARP must be disabled. A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can cause network mapping information to be stored incorrectly,
    SV-5646r5_rule NET0965 MEDIUM The network device must drop half-open TCP connections through filtering thresholds or timeout periods. A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An att
    SV-7365r4_rule NET1629 LOW The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the de
    SV-15301r3_rule NET0422 LOW Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration exceeding 180 days. If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being gues
    SV-15313r3_rule NET0744 MEDIUM Network devices must have BSDr commands disabled. Berkeley Software Distribution (BSD) "r" commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access wi
    SV-15327r4_rule NET0813 MEDIUM Network devices must authenticate all NTP messages received from NTP servers and peers. Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted
    SV-15336r3_rule NET0897 LOW The network device must use its loopback or OOB management interface address as the source address when originating authentication services traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15339r3_rule NET0898 LOW The network device must use its loopback or OOB management interface address as the source address when originating syslog traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15342r3_rule NET0899 LOW The network device must use its loopback or OOB management interface address as the source address when originating NTP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15345r3_rule NET0900 LOW The network device must use its loopback or OOB management interface address as the source address when originating SNMP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15348r3_rule NET0901 LOW The network device must use its loopback or OOB management interface address as the source address when originating IP Flow/NetFlow traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag
    SV-15351r4_rule NET0902 LOW The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network mana
    SV-15357r3_rule NET0903 LOW The network device must use its loopback interface address as the source address for all iBGP peering sessions. Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog ser
    SV-15459r4_rule NET1647 MEDIUM The network device must not allow SSH Version 1 to be used for administrative access. SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly
    SV-16259r4_rule NET0433 MEDIUM Network devices must use two or more authentication servers for the purpose of granting administrative access. The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ o
    SV-16261r4_rule NET0441 HIGH The emergency account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. The emergency account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level
    SV-19075r4_rule NET0991 MEDIUM The network devices OOBM interface must be configured with an OOBM network address. The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; there
    SV-19076r4_rule NET0992 MEDIUM The network devices management interface must be configured with both an ingress and egress ACL. The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface
    SV-19077r3_rule NET0993 LOW The management interface must be configured as passive for the IGP instance deployed in the managed network. The OOBM access switch will connect to the management interface of the managed network devices. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface
    SV-21027r3_rule NET0966 MEDIUM The network device must have control plane protection enabled. The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the router
    SV-28651r4_rule NET0812 LOW Network devices must use at least two NTP servers to synchronize time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the ex
    SV-40981r1_rule NET-VPN-010 HIGH The VPN gateway must use IKE for negotiating and establishing all IPSec security associations. An IPSec Security Associations (SA) is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If
    SV-40983r1_rule NET-VPN-020 HIGH The VPN gateway must authenticate the remote server, peer, or client prior to establishing an IPSec session. Both IPSec endpoints must authenticate each other to ensure the identity of each by additional means besides an IP address which can easily be spoofed. The objective of IPSec is to establish a secured tunnel with privacy between the two endpoints traversi
    SV-40985r1_rule NET-VPN-030 MEDIUM The VPN gateway must use PKI or digital-signature for authenticating the remote server, peer, or client. Using shared secrets between two IPSec endpoints is easy to implement but are also easy to compromise. Regardless of the strength of the password, they can be cracked using software tools that are readily available. Furthermore, implementation using share
    SV-40986r1_rule NET-VPN-040 MEDIUM The VPN gateway must only accept certificates issued by a DoD-approved Certificate Authority when using PKI for authentication. When using digital certificates, Internet Key Exchange (IKE) negotiation between peers is restricted by either manually configuring each peer with the public key for each peer to which it is allowed to connect, or enrolling each peer with a Certificate Au
    SV-40987r1_rule NET-VPN-250 MEDIUM The VPN gateway server must enforce a policy to the software client to disallow the remote client from being able to save the logon password locally on the remote PC. Enabling the password save function requires users to only enter their password once when establishing the VPN tunnel. After that the software client will automatically re-enter the password when prompted for credentials by the VPN gateway.Information Ass
    SV-40988r1_rule NET-VPN-240 MEDIUM The VPN gateway server must enforce a policy to the software client to display a DoD approved warning banner prior to allowing access to the VPN. All software remote clients must present a DoD approved warning banner prior allowing access to VPN. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized perso
    SV-40989r1_rule NET-VPN-050 MEDIUM The VPN gateway must not accept certificates that have been revoked when using PKI for authentication. Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised. To achieve this, a list of certific
    SV-40990r1_rule NET-VPN-230 MEDIUM The VPN gateway server must enforce a policy to the remote software client to check for the presence of a personal firewall before enabling access to the VPN. The security posture of the remote PC connecting to the enclave via VPN is vital to the overall security of the enclave. While on-site hosts are behind the enclave’s perimeter defense, a remote PC is not and therefore is exposed to many vulnerabilities
    SV-40992r1_rule NET-VPN-060 HIGH The VPN gateway must use Secure Hash Algorithm for IKE cryptographic hashing operations required for authentication and integrity verification. Because hash algorithms create a short fixed-length hash value to represent data of any size, there are far more possible input values than there are unique hash values. Hence, multiple input values exist that will produce the same hash value. This is kno
    SV-40993r1_rule NET-VPN-220 MEDIUM The VPN gateway server must enforce a no split-tunneling policy to all remote clients. A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path
    SV-40994r1_rule NET-VPN-070 HIGH The VPN gateway must use AES for IKE cryptographic encryption operations required to ensure privacy of the IKE session. While there is much debate about the security and performance of Advance Encryption Standard (AES), there is a consensus that it is significantly more secure than any of the algorithms supported by IPSec implementations today. AES is available in three ke
    SV-40995r1_rule NET-VPN-210 MEDIUM The VPN gateway peer at a remote site must receive all ingress traffic and forward all egress traffic via the IPSec tunnel or other provisoned WAN links connected to the central or remote site. A VPN gateway peer at the remote site provides connectivity to the central or other remote sites belonging to the enclave via an IPSec tunnel across an IP backbone network such as the NIPRNet. This creates an extension or Intranet for the enclave using IP
    SV-40996r1_rule NET-VPN-200 MEDIUM The VPN gateway must ensure traffic from a remote client with an outbound destination does not bypass the enclaves perimeter defense mechanisms deployed for egress traffic. Packets from a remote client destined outbound must be inspected and proxied the same as any other traffic that will egress the enclave. Otherwise, there is the risk that the return traffic that will ingress the IPSec tunnel could compromise the remote cl
    SV-40997r2_rule NET-VPN-190 HIGH IPSec Security Association parameters must be compliant with all requirements specified for VPN Suite B when transporting classified traffic across a non-classified network. RFC 6379 Suite B Cryptographic Suites for IPSec defines four cryptographic user interface suites for deploying IPSec. Each suite provides choices for Encapsulating Security Payload (ESP) and Internet Key Exchange (IKE). The four suites are differentiated
    SV-40998r1_rule NET-VPN-180 MEDIUM The VPN gateway must enable anti-replay for all IPSec security associations. Replay attack is a type of injection attack when an IPSec packet is captured by an attacker and re-inserts it into the legitimate flow to disrupt service or create undesired behavior. IPSec anti-replay service can mitigate a replay attack by running seque
    SV-40999r1_rule NET-VPN-080 LOW The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity
    SV-41001r1_rule NET-VPN-090 LOW The VPN gateway must use a key size from Diffie-Hellman Group 2 or larger during IKE Phase 1. Diffie-Hellman (DH) is a public-key cryptography scheme that allows two parties to establish a shared secret over an insecure communications channel. IKE uses DH to create keys used to encrypt both the Internet Key Exchange (IKE) and IPSec communication c
    SV-41002r1_rule NET-VPN-100 MEDIUM The VPN gateway must specify Perfect Forward Secrecy during IKE negotiation. The Internet Key Exchange (IKE) Phase-2 (Quick Mode) Security Association (SA) is used to create an IPSec session key. Hence, its rekey or key regeneration procedure is very important. The Phase-2 rekey can be performed with or without Perfect Forward Se
    SV-41003r1_rule NET-VPN-170 LOW The VPN gateway must implement IPSec security associations that terminate after one hour or less of idle time. When a VPN gateway creates an IPSec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPSec endpoint inactivity which could result in the gateway’s inability to create new SAs for oth
    SV-41004r1_rule NET-VPN-160 LOW The VPN gateway must implement IPSec security associations that terminate within 8 hours or less. The IPSec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA
    SV-41005r1_rule NET-VPN-110 LOW The VPN gateway must use a key size from Diffie-Hellman Group 2 or larger during IKE Phase 2. Diffie-Hellman (DH) is a public -key cryptography scheme allowing two parties to establish a shared secret over an insecure communications channel. IKE uses Diffie-Hellman to create keys used to encrypt both the Internet Key Exchange (IKE) and IPSec commu
    SV-41006r1_rule NET-VPN-150 HIGH The VPN gateway must use ESP tunnel mode for establishing secured paths to transport traffic between the organization’s sites or between a gateway and remote end-stations. Encapsulating Security Payload (ESP) is the feature in the IPSec architecture providing confidentiality, data origin authentication, integrity, and anti-replay services. ESP can be deployed in either transport or tunnel mode. Transport mode is used to cre
    SV-41007r1_rule NET-VPN-120 LOW The VPN gateway must implement IKE Security Associations that terminate within 24 hours or less. The Security Association (SA) and its corresponding key will expire after the number of seconds has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure a new SA is ready for use when
    SV-41008r1_rule NET-VPN-140 HIGH The VPN gateway must use AES for IPSec cryptographic encryption operations required to ensure privacy of the IPSec session. While there is much debate about the security and performance of Advance Encryption Standard (AES), there is a consensus it is significantly more secure than any of the algorithms supported by IPSec implementations today. AES is available in three key si
    SV-41009r1_rule NET-VPN-130 HIGH The VPN gateway must use Secure Hash Algorithm for IPSec cryptographic hashing operations required for authentication and integrity verification. Because hash algorithms create a short fixed-length hash value to represent data of any size, there are far more possible input values than there are unique hash values. Hence, multiple input values exist that will produce the same hash value. This is kno
    SV-41553r3_rule NET0408 MEDIUM Network devices must authenticate all BGP peers within the same or between autonomous systems (AS). As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 al