STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 10 Release: 7 Benchmark Date: 24 Oct 2024:

Tunneling of classified traffic across an unclassified IP transport network must employ cryptographic algorithms in accordance with CNSS Policy No. 15.

DISA Rule

SV-251351r916232_rule

Vulnerability Number

V-251351

Group Title

NET-TUNL-031

Rule Version

NET-TUNL-031

Severity

CAT I

CCI(s)

• CCI-002396 - Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.

Weight

10

Fix Recommendation

Configure the tunnel used for transporting classified traffic across an unclassified IP transport network to negotiate with the remote end point to employ cryptographic algorithms in accordance with CNSS Policy No. 15.

Check Contents

Review the configuration of the IPsec VPN gateway and verify that the tunnel provisioned for transporting classified traffic across an unclassified IP transport network is using cryptographic algorithms in accordance with CNSS Policy No. 15.

If cryptographic algorithms used for tunneling classified traffic across an unclassified network are not in accordance with CNSS Policy No. 15, this is a finding.

Vulnerability Number

V-251351

Documentable

False

Rule Version

NET-TUNL-031

Severity Override Guidance

Review the configuration of the IPsec VPN gateway and verify that the tunnel provisioned for transporting classified traffic across an unclassified IP transport network is using cryptographic algorithms in accordance with CNSS Policy No. 15.

If cryptographic algorithms used for tunneling classified traffic across an unclassified network are not in accordance with CNSS Policy No. 15, this is a finding.

Check Content Reference

M

Target Key

5444