STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS, when used as a VPN Gateway, must be configured to route sessions to an intrusion detection and prevention system (IDPS) for inspection.

DISA Rule

SV-266999r1040763_rule

Vulnerability Number

V-266999

Group Title

SRG-NET-000205-VPN-000710

Rule Version

ARBA-VN-000710

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
ip default-gateway <ipv4>
ipv6 default-gateway <ipv6>
ip route <A.B.C.D IPv4 network> <A.B.C.D netmask> <A.B.C.D nexthop> <cost>
ipv6 route <X:X:X:X::X IPv6 network/prefix> <X:X:X:X::X nexthop> <cost>
write memory

Check Contents

Verify the AOS configuration with the following commands:
show running-config | include default-gateway
show running-config | include "ipv4 route"
show running-config | include "ipv6 route"

If any routes exist that do not route sessions to an IDPS for inspection, this is a finding.

Vulnerability Number

V-266999

Documentable

False

Rule Version

ARBA-VN-000710

Severity Override Guidance

Verify the AOS configuration with the following commands:
show running-config | include default-gateway
show running-config | include "ipv4 route"
show running-config | include "ipv6 route"

If any routes exist that do not route sessions to an IDPS for inspection, this is a finding.

Check Content Reference

M

Target Key

5645