STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

For site-to-site VPN implementations using AOS, the Layer 2 Tunneling Protocol (L2TP) must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.

DISA Rule

SV-266991r1040739_rule

Vulnerability Number

V-266991

Group Title

SRG-NET-000132-VPN-000480

Rule Version

ARBA-VN-000480

Severity

CAT II

CCI(s)

CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

Fix Recommendation

Configure AOS with the following commands:
configure terminal
cd /mm
ip access-list session vpnlogon
any any svc-l2tp deny
exit
write memory
cd /mynode
vpdn group l2tp
disable
exit
write memory

Check Contents

Verify the AOS configuration with the following command:
show ip access-list vpnlogon
show firewall-cp

If L2TP or UDP 1701 are permitted, this is a finding.

Vulnerability Number

V-266991

Documentable

False

Rule Version

ARBA-VN-000480

Severity Override Guidance

Verify the AOS configuration with the following command:
show ip access-list vpnlogon
show firewall-cp

If L2TP or UDP 1701 are permitted, this is a finding.

Check Content Reference

Target Key

5645