STIGQter: STIG Summary: Juniper SRX Services Gateway VPN Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Juniper SRX Services Gateway VPN must disable split-tunneling for remote clients VPNs.

DISA Rule

SV-214695r383596_rule

Vulnerability Number

V-214695

Group Title

SRG-NET-000369

Rule Version

JUSX-VN-000028

Severity

CAT II

CCI(s)

• CCI-002397 - The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.

Weight

10

Fix Recommendation

Configure the VPN tunnel to control what is sent out in clear text. The “remote-protected-resources” command defines what is routed through the tunnel. The “remote-exceptions” command defines what traffic is sent out in clear text. The following is an example.

[edit]
set security dynamic-vpn access-profile <dynamic-vpn-access-profile>
set security dynamic-vpn clients all ipsec-vpn <ipsec-vpn-name>
set security dynamic-vpn clients all remote-protected-resources <IP-address/mask>
set security dynamic-vpn clients all remote-exceptions 0.0.0.0/0

Check Contents

Verify split-tunneling is disabled.

[edit]
show security dynamic-vpn access-profile <dynamic-vpn-access-profile>

If split-tunneling is not disabled, this is a finding.

Vulnerability Number

V-214695

Documentable

False

Rule Version

JUSX-VN-000028

Severity Override Guidance

Verify split-tunneling is disabled.

[edit]
show security dynamic-vpn access-profile <dynamic-vpn-access-profile>

If split-tunneling is not disabled, this is a finding.

Check Content Reference

M

Target Key

4009

Comments