STIGQter: STIG Summary: HPE Aruba Networking AOS VPN Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS, when used as a VPN Gateway, must disable split-tunneling for remote client VPNs.

DISA Rule

SV-267000r1040766_rule

Vulnerability Number

V-267000

Group Title

SRG-NET-000369-VPN-001620

Rule Version

ARBA-VN-001620

Severity

CAT II

CCI(s)

• CCI-002397 - Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.

Weight

10

Fix Recommendation

Configure AOS using the following commands:
configure terminal
wlan virtual-ap <profile name>
forward-mode tunnel
exit
write memory
ap system-profile <profile name>
double-encrypt
exit
write memory

For each VIA connection profile:
vaaa authentication via connection-profile <name>
no split-tunneling
exit
write memory

Check Contents

Verify the AOS configuration with the following commands:
show wlan virtual-ap

For each active WLAN virtual-ap profile:
show wlan virtual-ap <name> | include "Forward mode"

show ap system-profile

For each active AP system-profile:
show ap system-profile <name> | include "Double Encrypt"

show aaa authentication via connection-profile

For each referenced profile:
show aaa authentication via connection-profile <name> | include "Enable split tunneling"

If any instances of remote access or virtual-ap profile forward mode of split-tunnel are found or if double-encrypt is not enabled per active AP system profile, this is a finding.

Vulnerability Number

V-267000

Documentable

False

Rule Version

ARBA-VN-001620

Severity Override Guidance

Verify the AOS configuration with the following commands:
show wlan virtual-ap

For each active WLAN virtual-ap profile:
show wlan virtual-ap <name> | include "Forward mode"

show ap system-profile

For each active AP system-profile:
show ap system-profile <name> | include "Double Encrypt"

show aaa authentication via connection-profile

For each referenced profile:
show aaa authentication via connection-profile <name> | include "Enable split tunneling"

If any instances of remote access or virtual-ap profile forward mode of split-tunnel are found or if double-encrypt is not enabled per active AP system profile, this is a finding.

Check Content Reference

M

Target Key

5645