Detections
Analytics
ARBA-VN-001620 - AOS, when used as a VPN Gateway, must disable split-tunneling for remote client VPNs.
Information
Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the internet. With split tunneling enabled, a remote client has access to the internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the internet that has been compromised by an attacker on the internet provides an attack base to the enclave's private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure AOS using the following commands:configure terminal
wlan virtual-ap <profile name>
forward-mode tunnel
exit
write memory
ap system-profile <profile name>
double-encrypt
exit
write memory
For each VIA connection profile:
vaaa authentication via connection-profile <name>
no split-tunneling
exit
write memory
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_HPE_Aruba_Networking_AOS_Y26M04_STIG.zip
Item Details
Audit Name: DISA HPE Aruba Networking AOS VPN STIG v1r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(7), CAT|II, CCI|CCI-002397, Rule-ID|SV-267000r1040766_rule, STIG-ID|ARBA-VN-001620, Vuln-ID|V-267000
Plugin: ArubaOS
Control ID: 82a235c800e5a66c0ce7a7842fda8f151305104318d03fc6ed755ebe33234b87