Detections
Analytics
ARBA-VN-000470 - The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).
Information
PPTP and L2F are obsolete methods for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.Solution
Configure AOS with the following commands:configure terminal
cd /mm
ip access-list session vpnlogon
any any svc-pptp deny
exit
write memory
cd /mynode
firewall cp
ipv4 deny any proto 6 ports 1723 1723
ipv6 deny any proto 6 ports 1723 1723
exit
write memory
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_HPE_Aruba_Networking_AOS_Y26M04_STIG.zip
Item Details
Audit Name: DISA HPE Aruba Networking AOS VPN STIG v1r1
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7b., CAT|II, CCI|CCI-000382, Rule-ID|SV-266998r1040760_rule, STIG-ID|ARBA-VN-000470, Vuln-ID|V-266998
Plugin: ArubaOS
Control ID: 944cb1e616100e97ea19adfe302a6385daafc526e1f08edf65e39e8ffcc3862c