F5BI-VN-300004 - The F5 BIG-IP appliance must be configured to use a Diffie-Hellman (DH) Group of 16 or greater for Internet Key Exchange (IKE) Phase 1.

800-53|AC-17(2)

CAT|I

CCI|CCI-000068

Rule-ID|SV-266277r1024911_rule

STIG-ID|F5BI-VN-300004

Vuln-ID|V-266277

F5BI-VN-300005 - The F5 BIG-IP appliance IPsec VPN Gateway must use AES256 or higher encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.

Rule-ID|SV-266278r1024913_rule

STIG-ID|F5BI-VN-300005

Vuln-ID|V-266278

F5BI-VN-300006 - The F5 BIG-IP appliance IPsec VPN must use AES256 or greater encryption for the IPsec proposal.

Rule-ID|SV-266279r1024915_rule

STIG-ID|F5BI-VN-300006

Vuln-ID|V-266279

F5BI-VN-300009 - The F5 BIG-IP appliance IPsec VPN must ensure inbound and outbound traffic is configured with a security policy.

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-266280r1024917_rule

STIG-ID|F5BI-VN-300009

Vuln-ID|V-266280

F5BI-VN-300021 - The F5 BIG-IP appliance IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-266281r1024756_rule

STIG-ID|F5BI-VN-300021

Vuln-ID|V-266281

F5BI-VN-300024 - The IPsec BIG-IP appliance must use IKEv2 for IPsec VPN security associations.

800-53|CM-7b.

CAT|II

CCI|CCI-000382

Rule-ID|SV-266282r1024757_rule

STIG-ID|F5BI-VN-300024

Vuln-ID|V-266282

F5BI-VN-300025 - The F5 BIG-IP appliance IPsec VPN Gateway must renegotiate the IPsec Phase 1 security association after eight hours or less.

800-53|IA-11

CCI|CCI-002038

Rule-ID|SV-266283r1024758_rule

STIG-ID|F5BI-VN-300025

Vuln-ID|V-266283

F5BI-VN-300026 - The F5 BIG-IP appliance IPsec VPN must renegotiate the IKE Phase 2 security association after eight hours or less.

Rule-ID|SV-266284r1024759_rule

STIG-ID|F5BI-VN-300026

Vuln-ID|V-266284

F5BI-VN-300033 - For accounts using password authentication, the F5 BIG-IP appliance site-to-site IPsec VPN Gateway must use SHA-2 or later protocol to protect the integrity of the password authentication process.

800-53|IA-5(1)(c)

CCI|CCI-000197

Rule-ID|SV-266285r1024760_rule

STIG-ID|F5BI-VN-300033

Vuln-ID|V-266285

F5BI-VN-300040 - The F5 BIG-IP appliance IPsec VPN must use cryptographic algorithms approved by NSA to protect NSS when transporting classified traffic across an unclassified network.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-266286r1024761_rule

STIG-ID|F5BI-VN-300040

Vuln-ID|V-266286

F5BI-VN-300041 - The F5 BIG-IP appliance IPsec VPN must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE).

800-53|SC-23

CCI|CCI-001184

Rule-ID|SV-266287r1024762_rule

STIG-ID|F5BI-VN-300041

Vuln-ID|V-266287

F5BI-VN-300044 - The F5 BIG-IP appliance IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.

Detections

Analytics

DISA F5 BIG-IP TMOS VPN STIG v1r1

Audit Details

File Details

Audit Changelog

No revisions found