STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS, when used as a VPN Gateway, must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.

DISA Rule

SV-266992r1040904_rule

Vulnerability Number

V-266992

Group Title

SRG-NET-000019-VPN-000040

Rule Version

ARBA-VN-000040

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
ip access-list session <name>
network <A.B.C.D> <netmask A.B.C.D> any any permit
any any any deny log
ipv6 network <X:X:X:X::X/<0-128> any any permit
ipv6 any any any deny log
exit
write memory
interface gigabit <#/#/#>
ip access-group session <ACL name>
exit
write mem

Check Contents

Verify the AOS configuration with the following command:
show running-config | begin "interface gigabit"

Note the configured IP access-group session ACL for each active interface.

For each configured ACL:
show ip access-list <ACL name>

If each ACL does not end in an "any any deny log" for both IPv4 and IPv6, this is a finding.

Vulnerability Number

V-266992

Documentable

False

Rule Version

ARBA-VN-000040

Severity Override Guidance

Verify the AOS configuration with the following command:
show running-config | begin "interface gigabit"

Note the configured IP access-group session ACL for each active interface.

For each configured ACL:
show ip access-list <ACL name>

If each ACL does not end in an "any any deny log" for both IPv4 and IPv6, this is a finding.

Check Content Reference

M

Target Key

5645