STIGQter: STIG Summary: Juniper SRX Services Gateway VPN Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway VPN must use AES256 for the IPsec proposal to protect the confidentiality of remote access sessions.

DISA Rule

SV-214672r1056079_rule

Vulnerability Number

V-214672

Group Title

SRG-NET-000062

Rule Version

JUSX-VN-000005

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

The following example commands configure the IPsec (phase 2) proposals.

[edit]
set security ipsec proposal <IPSEC-PROPOSAL-NAME> encryption-algorithm aes-256-cbc

Check Contents

Verify all Internet Key Exchange (IKE) proposals are set to use the AES256 encryption algorithm.

[edit]
show security ipsec

View the value of the encryption algorithm for each defined proposal.

If the value of the encryption algorithm for any IPsec proposal is not set to use an AES256 algorithm, this is a finding.

Vulnerability Number

V-214672

Documentable

False

Rule Version

JUSX-VN-000005

Severity Override Guidance

Verify all Internet Key Exchange (IKE) proposals are set to use the AES256 encryption algorithm.

[edit]
show security ipsec

View the value of the encryption algorithm for each defined proposal.

If the value of the encryption algorithm for any IPsec proposal is not set to use an AES256 algorithm, this is a finding.

Check Content Reference

M

Target Key

4009