STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-266995r1040751_rule

Vulnerability Number

V-266995

Group Title

SRG-NET-000138-VPN-000490

Rule Version

ARBA-VN-000490

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.

Weight

10

Fix Recommendation

Configure AOS with the following commands:

1. crypto pki csr ec curve_name secp384r1 common_name <common_name> country <US> state_or_province <state> city <city> organization <org> unit <unit> email <email>
show crypto pki csr
2. Use DOD PKI to generate a public certificate based on the CSR.
3. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates.
4. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, select Certificate type: "ServerCert", and click "Submit".
5. Click Pending Changes >> Deploy Changes.

Continue configuring with the CLI:
configure terminal
crypto-local isakmp ca-certificate <CA certificate name>
crypto-local isakmp certificate-group server-certificate <EC certificate name> ca-certificate <CA certificate name>
write memory

crypto dynamic-map <name> <priority>
version v2
set pfs group20
set transform-set default-gcm256
set security-association lifetime seconds 28800
exit
write memory

aaa authentication-server radius <name>
host <A.B.C.D or X:X:X:X::X or hostname>
key <preshared key>
enable
exit
write memory

aaa server-group <name>
auth-server <name>
exit
write memory

ip access-list session <name>
any any any permit
ipv6 any any any permit
exit
write memory

user-role <name>
access-list session <name>
exit
write memory

aaa authentication via auth-profile <name>
default-role <name>
client-cert-enable
server-group <name>
exit
write memory

aaa authentication via connection-profile <name>
auth-profile <name>
enable-fips
ikev2-policy 10009
ikev2-proto
ikev2auth eap-tls
ipsecv2-cryptomap map <name> number <priority>
max-timeout value <0-65535>
suiteb-crypto
validate-server-cert
exit
write memory

aaa authentication via web-auth default
auth-profile <name>
exit
write memory

user-role <name>
via <name>
exit
write memory

Check Contents

Verify the AOS configuration with the following commands:
show aaa authentication via connection-profile

Note each referenced VIA connection profile.

For each referenced connection profile:
show aaa authentication via connection-profile <name> | include "IKEv2 Authentication method"

If the authentication method is not set to "eap-tls", this is a finding.

Vulnerability Number

V-266995

Documentable

False

Rule Version

ARBA-VN-000490

Severity Override Guidance

Verify the AOS configuration with the following commands:
show aaa authentication via connection-profile

Note each referenced VIA connection profile.

For each referenced connection profile:
show aaa authentication via connection-profile <name> | include "IKEv2 Authentication method"

If the authentication method is not set to "eap-tls", this is a finding.

Check Content Reference

M

Target Key

5645