STIGQter: STIG Summary: Juniper SRX Services Gateway VPN Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

DISA Rule

SV-214689r1056184_rule

Vulnerability Number

V-214689

Group Title

SRG-NET-000213

Rule Version

JUSX-VN-000022

Severity

CAT II

CCI(s)

CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

Fix Recommendation

For site-to-site VPN, configure an Internet Key Exchange (IKE) gateway that includes DPD parameters such as in the following example.

set security ike gateway IKE-PEER ike-policy IKE-POLICY
set security ike gateway IKE-PEER address <Peer IP Address>
set security ike gateway IKE-PEER dead-peer-detection always-send
set security ike gateway IKE-PEER dead-peer-detection interval 10
set security ike gateway IKE-PEER dead-peer-detection threshold 2
set security ike gateway IKE-PEER local-identity inet <IPv4 Address in Certificate>
set security ike gateway IKE-PEER remote-identity inet <IPv4 Address in Remote
Certificate>
set security ike gateway IKE-PEER external-interface <interface name>
set security ike gateway IKE-PEER version v2-only

Check Contents

Navigate to the IKE configuration.

[edit]
show security ike gateway <ike-peer-name>

If the DPD options are not configured, this is a finding.

Vulnerability Number

V-214689

Documentable

False

Rule Version

JUSX-VN-000022

Severity Override Guidance

Navigate to the IKE configuration.

[edit]
show security ike gateway <ike-peer-name>

If the DPD options are not configured, this is a finding.

Check Content Reference

Target Key

4009