STIGQter: STIG Summary: Juniper SRX Services Gateway VPN Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Juniper SRX Services Gateway VPN IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.

DISA Rule

SV-214691r383878_rule

Vulnerability Number

V-214691

Group Title

SRG-NET-000510

Rule Version

JUSX-VN-000024

Severity

CAT II

CCI(s)

• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

The following example commands configure the IKE (phase 1) proposal.

[edit]
set security ike proposal <P1-PROPOSAL> authentication-method rsa-signatures
set security ike proposal p1-proposal dh-group group14
set security ike proposal p1-proposal authentication-algorithm sha-256
set security ike proposal p1-proposal encryption-algorithm aes-256-cbc
set security ike proposal p1-proposal lifetime-seconds 86400

Check Contents

Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.

[edit]
show security ike

View the value of the encryption algorithm for each defined proposal.

If the value of the authentication method and other options are not set to use FIPS-compliant values, this is a finding.

Vulnerability Number

V-214691

Documentable

False

Rule Version

JUSX-VN-000024

Severity Override Guidance

Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.

[edit]
show security ike

View the value of the encryption algorithm for each defined proposal.

If the value of the authentication method and other options are not set to use FIPS-compliant values, this is a finding.

Check Content Reference

M

Target Key

4009

Comments