STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).

DISA Rule

SV-266998r1040760_rule

Vulnerability Number

V-266998

Group Title

SRG-NET-000132-VPN-000470

Rule Version

ARBA-VN-000470

Severity

CAT II

CCI(s)

CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

Fix Recommendation

Configure AOS with the following commands:
configure terminal
cd /mm
ip access-list session vpnlogon
any any svc-pptp deny
exit
write memory
cd /mynode
firewall cp
ipv4 deny any proto 6 ports 1723 1723
ipv6 deny any proto 6 ports 1723 1723
exit
write memory

Check Contents

Verify the AOS configuration with the following commands:
show ip access-list vpnlogon
show firewall-cp

If PPTP or TCP 1723 are permitted, this is a finding.

Vulnerability Number

V-266998

Documentable

False

Rule Version

ARBA-VN-000470

Severity Override Guidance

Verify the AOS configuration with the following commands:
show ip access-list vpnlogon
show firewall-cp

If PPTP or TCP 1723 are permitted, this is a finding.

Check Content Reference

Target Key

5645