JUSX-VN-000001 - The Juniper SRX Services Gateway VPN must limit the number of concurrent sessions for user accounts to one (1) and administrative accounts to three (3), or set to an organization-defined number.

CAT|II

CCI|CCI-000054

CCI|CCI-004866

Rule-ID|SV-214668r997551_rule

STIG-ID|JUSX-VN-000001

STIG-Legacy|SV-81119

STIG-Legacy|V-66629

Vuln-ID|V-214668

JUSX-VN-000002 - The Juniper SRX Services Gateway VPN must renegotiate the IPsec security association after 8 hours or less.

CCI|CCI-002361

Rule-ID|SV-214669r856572_rule

STIG-ID|JUSX-VN-000002

STIG-Legacy|SV-81121

STIG-Legacy|V-66631

Vuln-ID|V-214669

JUSX-VN-000003 - The Juniper SRX Services Gateway VPN must renegotiate the IKE security association after 24 hours or less.

Rule-ID|SV-214670r856574_rule

STIG-ID|JUSX-VN-000003

STIG-Legacy|SV-81133

STIG-Legacy|V-66643

Vuln-ID|V-214670

JUSX-VN-000004 - The Juniper SRX Services Gateway VPN device also fulfills the role of IDPS in the architecture, the device must inspect the VPN traffic in compliance with DoD IDPS requirements.

CCI|CCI-000067

Rule-ID|SV-214671r382780_rule

STIG-ID|JUSX-VN-000004

STIG-Legacy|SV-81135

STIG-Legacy|V-66645

Vuln-ID|V-214671

JUSX-VN-000005 - The Juniper SRX Services Gateway VPN must use AES encryption for the IPsec proposal to protect the confidentiality of remote access sessions.

CAT|I

CCI|CCI-000068

CCI|CCI-004891

Rule-ID|SV-214672r997552_rule

STIG-ID|JUSX-VN-000005

STIG-Legacy|SV-80511

STIG-Legacy|V-66021

Vuln-ID|V-214672

JUSX-VN-000006 - The Juniper SRX Services Gateway VPN must use AES encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.

Rule-ID|SV-214673r997553_rule

STIG-ID|JUSX-VN-000006

STIG-Legacy|SV-81107

STIG-Legacy|V-66617

Vuln-ID|V-214673

JUSX-VN-000007 - The Juniper SRX Services Gateway VPN must implement a FIPS-140-2 validated Diffie-Hellman (DH) group.

Rule-ID|SV-214674r997554_rule

STIG-ID|JUSX-VN-000007

STIG-Legacy|SV-81137

STIG-Legacy|V-66647

Vuln-ID|V-214674

JUSX-VN-000008 - The Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA1 or greater to negotiate hashing to protect the integrity of remote access sessions.

CCI|CCI-001453

Rule-ID|SV-214675r382846_rule

STIG-ID|JUSX-VN-000008

STIG-Legacy|SV-81139

STIG-Legacy|V-66649

Vuln-ID|V-214675

JUSX-VN-000009 - The Juniper SRX Services Gateway VPN must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.

CCI|CCI-001414

Rule-ID|SV-214676r382735_rule

STIG-ID|JUSX-VN-000009

STIG-Legacy|SV-81141

STIG-Legacy|V-66651

Vuln-ID|V-214676

JUSX-VN-000010 - The Juniper SRX Services Gateway VPN must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).

CCI|CCI-000366

Rule-ID|SV-214677r385561_rule

STIG-ID|JUSX-VN-000010

STIG-Legacy|SV-81109

STIG-Legacy|V-66619

Vuln-ID|V-214677

JUSX-VN-000011 - If IDPS inspection is performed separately from the Juniper SRX Services Gateway VPN device, the VPN must route sessions to an IDPS for inspection.

Rule-ID|SV-214678r864169_rule

STIG-ID|JUSX-VN-000011

STIG-Legacy|SV-81143

STIG-Legacy|V-66653

Vuln-ID|V-214678

JUSX-VN-000012 - The Juniper SRX Services Gateway VPN must not accept certificates that have been revoked when using PKI for authentication.

Rule-ID|SV-214679r385561_rule

STIG-ID|JUSX-VN-000012

STIG-Legacy|SV-81111

STIG-Legacy|V-66621

Vuln-ID|V-214679

JUSX-VN-000013 - The Juniper SRX Services Gateway VPN must specify Perfect Forward Secrecy (PFS).

Rule-ID|SV-214680r385561_rule

STIG-ID|JUSX-VN-000013

STIG-Legacy|SV-81145

STIG-Legacy|V-66655

Vuln-ID|V-214680

JUSX-VN-000014 - The Juniper SRX Services Gateway VPN must use Encapsulating Security Payload (ESP) in tunnel mode.

Rule-ID|SV-214681r385561_rule

STIG-ID|JUSX-VN-000014

STIG-Legacy|SV-81147

STIG-Legacy|V-66657

Vuln-ID|V-214681

JUSX-VN-000015 - The Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

CCI|CCI-000381

Rule-ID|SV-214682r382903_rule

STIG-ID|JUSX-VN-000015

STIG-Legacy|SV-81149

STIG-Legacy|V-66659

Vuln-ID|V-214682

JUSX-VN-000016 - The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

CCI|CCI-000382

Rule-ID|SV-214683r997555_rule

STIG-ID|JUSX-VN-000016

STIG-Legacy|SV-81151

STIG-Legacy|V-66661

Vuln-ID|V-214683

JUSX-VN-000017 - The Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

Rule-ID|SV-214684r385486_rule

STIG-ID|JUSX-VN-000017

STIG-Legacy|SV-81153

STIG-Legacy|V-66663

Vuln-ID|V-214684

JUSX-VN-000018 - The Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-214685r385489_rule

STIG-ID|JUSX-VN-000018

STIG-Legacy|SV-81155

STIG-Legacy|V-66665

Vuln-ID|V-214685

JUSX-VN-000019 - The Juniper SRX Services Gateway VPN must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.

CCI|CCI-000766

Rule-ID|SV-214686r954210_rule

STIG-ID|JUSX-VN-000019

STIG-Legacy|SV-81113

STIG-Legacy|V-66623

Vuln-ID|V-214686

JUSX-VN-000020 - The Juniper SRX Services Gateway VPN must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.

CCI|CCI-000803

Rule-ID|SV-214687r385516_rule

STIG-ID|JUSX-VN-000020

STIG-Legacy|SV-81157

STIG-Legacy|V-66667

Vuln-ID|V-214687

JUSX-VN-000021 - The Juniper SRX Services Gateway VPN must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

CCI|CCI-000804

Rule-ID|SV-214688r385519_rule

STIG-ID|JUSX-VN-000021

STIG-Legacy|SV-81159

STIG-Legacy|V-66669

Vuln-ID|V-214688

JUSX-VN-000022 - The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

CAT|III

CCI|CCI-001133

Rule-ID|SV-214689r971530_rule

STIG-ID|JUSX-VN-000022

STIG-Legacy|SV-81171

STIG-Legacy|V-66681

Vuln-ID|V-214689

JUSX-VN-000023 - The Juniper SRX Services Gateway VPN Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.

CCI|CCI-002450

Rule-ID|SV-214690r878132_rule

STIG-ID|JUSX-VN-000023

STIG-Legacy|SV-81115

STIG-Legacy|V-66625

Vuln-ID|V-214690

JUSX-VN-000024 - The Juniper SRX Services Gateway VPN IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.

Rule-ID|SV-214691r856576_rule

STIG-ID|JUSX-VN-000024

STIG-Legacy|SV-81161

STIG-Legacy|V-66671

Vuln-ID|V-214691

JUSX-VN-000025 - The Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.

CCI|CCI-001184

Rule-ID|SV-214692r383107_rule

STIG-ID|JUSX-VN-000025

STIG-Legacy|SV-81131

STIG-Legacy|V-66641

Vuln-ID|V-214692

JUSX-VN-000026 - The Juniper SRX Services Gateway VPN must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.

CCI|CCI-002470

Rule-ID|SV-214693r856577_rule

STIG-ID|JUSX-VN-000026

STIG-Legacy|SV-81163

STIG-Legacy|V-66673

Vuln-ID|V-214693

JUSX-VN-000027 - The Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations.

CCI|CCI-002403

Rule-ID|SV-214694r856578_rule

STIG-ID|JUSX-VN-000027

STIG-Legacy|SV-81165

STIG-Legacy|V-66675

Vuln-ID|V-214694

JUSX-VN-000028 - The Juniper SRX Services Gateway VPN must disable split-tunneling for remote clients VPNs.

CCI|CCI-002397

Rule-ID|SV-214695r856579_rule

STIG-ID|JUSX-VN-000028

STIG-Legacy|SV-81167

STIG-Legacy|V-66677

Vuln-ID|V-214695

JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.

Detections

Analytics

DISA Juniper SRX Services Gateway VPN v3r1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Sep 16, 2025 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Nov 22, 2024 Miscellaneous Metadata updated. See also link updated.

Detections

Analytics

DISA Juniper SRX Services Gateway VPN v3r1 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Juniper SRX Services Gateway VPN v3r1