STIGQter STIGQter: STIG Summary: HPE Aruba Networking AOS Wireless Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

AOS must use cryptographic algorithms approved by the National Security Agency (NSA) to protect national security systems (NSS) when transporting classified traffic across an unclassified network.

DISA Rule

SV-266639r1117244_rule

Vulnerability Number

V-266639

Group Title

SRG-NET-000352

Rule Version

ARBA-NT-000920

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure AOS with the following commands:
crypto pki csr ec curve_name secp384r1 common_name <common_name> country <US> state_or_province <state> city <city> organization <org> unit <unit> email <email>
show crypto pki csr

1. Use DOD PKI to generate a public certificate based on the CSR.
2. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates.
3. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, "ServerCert" type, and click "Submit".
4. Navigate to Configuration >> System >> Admin, choose the imported certificate under "Server Certificate", and click "Submit".
5. Click Pending Changes >> Deploy Changes.

configure terminal
crypto ipsec transform-set <name> esp-aes256-gcm
crypto isakmp policy <#>
authentication ecdsa-384
encryption aes256
group 20
hash sha2-384-192
prf prf-hmac-sha384
version v2
exit
crypto-local ipsec-map <name> <priority>
set transform-set <set created earlier name>
<configure VPN settings as needed>
exit
write memory

Check Contents

If AOS is not being used for CSFC, this requirement is not applicable.

1. Verify the AOS configuration with the following command:
show crypto-local ipsec-map

Note the IKEv2 Policy number for each configured map.

2. For each configured policy number, run the following command:
show crypto isakmp policy <IKEv2 Policy #>

3. Verify each configured transform-set with the following command:
show crypto ipsec transform-set

If the configured IPsec map, ISAKMP policy, and transform-set do not contain the following, this is a finding:

ECDCA 384 certificate
IKEv2 policy with AES256, SHA-384, ECDSA-384, Group 20
Transform set with AES-256-GCM

Vulnerability Number

V-266639

Documentable

False

Rule Version

ARBA-NT-000920

Severity Override Guidance

If AOS is not being used for CSFC, this requirement is not applicable.

1. Verify the AOS configuration with the following command:
show crypto-local ipsec-map

Note the IKEv2 Policy number for each configured map.

2. For each configured policy number, run the following command:
show crypto isakmp policy <IKEv2 Policy #>

3. Verify each configured transform-set with the following command:
show crypto ipsec transform-set

If the configured IPsec map, ISAKMP policy, and transform-set do not contain the following, this is a finding:

ECDCA 384 certificate
IKEv2 policy with AES256, SHA-384, ECDSA-384, Group 20
Transform set with AES-256-GCM

Check Content Reference

M

Target Key

5646