STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.

DISA Rule

SV-266997r1040757_rule

Vulnerability Number

V-266997

Group Title

SRG-NET-000337-VPN-001300

Rule Version

ARBA-VN-001300

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
crypto-local ipsec-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory

crypto dynamic-map <name> <priority>
set security-association lifetime seconds 28800
exit
write memory

Check Contents

Verify the AOS configuration with the following commands:
show crypto-local ipsec-map
show crypto dynamic-map

If the configured IPSec maps are not configured to support a security association lifetime of 28,800 seconds (8 hours), this is a finding.

Vulnerability Number

V-266997

Documentable

False

Rule Version

ARBA-VN-001300

Severity Override Guidance

Verify the AOS configuration with the following commands:
show crypto-local ipsec-map
show crypto dynamic-map

If the configured IPSec maps are not configured to support a security association lifetime of 28,800 seconds (8 hours), this is a finding.

Check Content Reference

M

Target Key

5645