STIGQter: STIG Summary: Juniper SRX Services Gateway VPN Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway VPN must use AES256 encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.

DISA Rule

SV-214673r1056082_rule

Vulnerability Number

V-214673

Group Title

SRG-NET-000062

Rule Version

JUSX-VN-000006

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

The following example commands configure the IKE (phase 1) proposals.

[edit]
set security ike proposal <IKE-PROPOSAL-NAME> encryption-algorithm aes-256-cbc

Check Contents

Verify all IKE proposals are set to use the AES256 encryption algorithm.

[edit]
show security ike

View the value of the encryption algorithm for each defined proposal.

If the value of the encryption algorithm for any IKE proposal is not configured to use AES256, this is a finding.

Vulnerability Number

V-214673

Documentable

False

Rule Version

JUSX-VN-000006

Severity Override Guidance

Verify all IKE proposals are set to use the AES256 encryption algorithm.

[edit]
show security ike

View the value of the encryption algorithm for each defined proposal.

If the value of the encryption algorithm for any IKE proposal is not configured to use AES256, this is a finding.

Check Content Reference

M

Target Key

4009