ARBA-VN-000040 - AOS, when used as a VPN Gateway, must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001414

Rule-ID|SV-266992r1040904_rule

STIG-ID|ARBA-VN-000040

Vuln-ID|V-266992

ARBA-VN-000110 - The Remote Access VPN Gateway and/or client must display the Standard Mandatory DOD Notice and Consent Banner before granting remote access to the network.

800-53|AC-8a.

800-53|AC-8b.

800-53|AC-8c.1.

800-53|AC-8c.2.

800-53|AC-8c.3.

CCI|CCI-000048

CCI|CCI-000050

CCI|CCI-001384

CCI|CCI-001385

CCI|CCI-001386

CCI|CCI-001387

CCI|CCI-001388

Rule-ID|SV-266989r1040733_rule

STIG-ID|ARBA-VN-000110

Vuln-ID|V-266989

ARBA-VN-000170 - AOS, when used as a VPN Gateway, must limit the number of concurrent sessions for user accounts to one or to an organization-defined number.

800-53|AC-10

CCI|CCI-000054

Rule-ID|SV-266993r1040745_rule

STIG-ID|ARBA-VN-000170

Vuln-ID|V-266993

ARBA-VN-000220 - AOS, when used as a VPN Gateway, must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.

800-53|AC-17(2)

800-53|IA-7

800-53|SC-23

CCI|CCI-000068

CCI|CCI-000803

CCI|CCI-001184

CCI|CCI-001453

Rule-ID|SV-266983r1040715_rule

STIG-ID|ARBA-VN-000220

Vuln-ID|V-266983

ARBA-VN-000470 - The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-266998r1040760_rule

STIG-ID|ARBA-VN-000470

Vuln-ID|V-266998

ARBA-VN-000480 - For site-to-site VPN implementations using AOS, the Layer 2 Tunneling Protocol (L2TP) must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.

Rule-ID|SV-266991r1040739_rule

STIG-ID|ARBA-VN-000480

Vuln-ID|V-266991

ARBA-VN-000490 - The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

800-53|IA-2(12)

800-53|IA-5(2)(c)

CCI|CCI-000187

CCI|CCI-000764

CCI|CCI-001953

Rule-ID|SV-266995r1040751_rule

STIG-ID|ARBA-VN-000490

Vuln-ID|V-266995

ARBA-VN-000540 - AOS, when used as a VPN Gateway, must uniquely identify all network-connected endpoint devices before establishing a connection.

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-266987r1040727_rule

STIG-ID|ARBA-VN-000540

Vuln-ID|V-266987

ARBA-VN-000560 - AOS, when used as a VPN Gateway and using public key infrastructure (PKI)-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-266984r1040891_rule

STIG-ID|ARBA-VN-000560

Vuln-ID|V-266984

ARBA-VN-000580 - The Remote Access VPN Gateway must use a separate authentication server (e.g., Lightweight Directory Access Protocol [LDAP], Remote Authentication Dial-In User Service [RADIUS], Terminal Access Controller Access-Control System+ [TACACS+] to perform user authentication.

Rule-ID|SV-266994r1040748_rule

STIG-ID|ARBA-VN-000580

Vuln-ID|V-266994

ARBA-VN-000710 - AOS, when used as a VPN Gateway, must be configured to route sessions to an intrusion detection and prevention system (IDPS) for inspection.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-266999r1040763_rule

STIG-ID|ARBA-VN-000710

Vuln-ID|V-266999

ARBA-VN-000720 - AOS, when used as a VPN Gateway, must terminate all network connections associated with a communications session at the end of the session.

800-53|SC-10

CAT|III

CCI|CCI-001133

Rule-ID|SV-266990r1040736_rule

STIG-ID|ARBA-VN-000720

Vuln-ID|V-266990

ARBA-VN-000721 - The Remote Access VPN Gateway must terminate remote access network connections after an organization-defined time period.

800-53|AC-11a.

CCI|CCI-000057

Rule-ID|SV-266996r1040892_rule

STIG-ID|ARBA-VN-000721

Vuln-ID|V-266996

ARBA-VN-001090 - AOS, when used as an IPsec VPN Gateway, must use Advanced Encryption Standard (AES) encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.

800-53|IA-5(1)(c)

800-53|SC-8

CAT|I

CCI|CCI-000197

CCI|CCI-002418

Rule-ID|SV-266985r1040721_rule

STIG-ID|ARBA-VN-001090

Vuln-ID|V-266985

ARBA-VN-001300 - AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.

800-53|IA-11

CCI|CCI-002038

Rule-ID|SV-266997r1040757_rule

STIG-ID|ARBA-VN-001300

Vuln-ID|V-266997

ARBA-VN-001370 - AOS, when used as a VPN Gateway, must authenticate all network-connected endpoint devices before establishing a connection.

CCI|CCI-001958

Rule-ID|SV-266988r1040893_rule

STIG-ID|ARBA-VN-001370

Vuln-ID|V-266988

ARBA-VN-001460 - AOS, when used as a VPN Gateway, must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-266986r1040894_rule

STIG-ID|ARBA-VN-001460

Vuln-ID|V-266986

ARBA-VN-001620 - AOS, when used as a VPN Gateway, must disable split-tunneling for remote client VPNs.

800-53|SC-7(7)

CCI|CCI-002397

Rule-ID|SV-267000r1040766_rule

STIG-ID|ARBA-VN-001620

Vuln-ID|V-267000

ARBA-VN-001640 - AOS, when used as an IPsec VPN Gateway, must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.

Rule-ID|SV-266982r1040712_rule

STIG-ID|ARBA-VN-001640

Vuln-ID|V-266982

ARBA-VN-002220 - AOS, when used as an IPsec VPN Gateway, must use Internet Key Exchange (IKE) for IPsec VPN security associations (SAs).

800-53|CM-6b.

800-53|IA-2(9)

CCI|CCI-000366

CCI|CCI-001942

Rule-ID|SV-267001r1040895_rule

STIG-ID|ARBA-VN-002220

Vuln-ID|V-267001

ARBA-VN-002430 - AOS, when used as a VPN Gateway, must not accept certificates that have been revoked when using PKI for authentication.

Detections

Analytics

DISA HPE Aruba Networking AOS VPN STIG v1r1

Audit Details

File Details

Audit Changelog

No revisions found