ARBA-NT-000120 - AOS must protect wireless access to the network using authentication of users and/or devices.

Information

Allowing devices and users to connect to the system without first authenticating them allows untrusted access and can lead to a compromise or attack.

The security boundary of a wireless local area network (WLAN) extends from the client device to the network boundary where network access is controlled. This boundary represents the portion of the network most vulnerable to attack and must be protected. Within this boundary there must be two distinct, but related, security protection mechanisms: authentication and data-in-transit encryption. These protections ensure access control and protection from eavesdropping for both the WLAN system and the DOD network enclave.

Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., Extensible Authentication Protocol (EAP)/Transport Layer Security (TLS) and Protected EAP [PEAP]), which provide credential protection and mutual authentication.

Satisfies: SRG-NET-000069, SRG-NET-000070

Solution

Configure AOS with the following commands:
configure terminal
wlan ssid-profile <profile name>
opmode <wpa2-aes or wpa3-cnsa>
exit
write memory

Item Details

Audit Name: DISA HPE Aruba Networking AOS Wireless STIG v1r2

Category: ACCESS CONTROL

Plugin: ArubaOS

Control ID: ae7f5dbacf6665b3d4d40ae0bf2ab160030aa224f3073e0f6de309f1518e9033

Detections

Analytics

ARBA-NT-000120 - AOS must protect wireless access to the network using authentication of users and/or devices.

Information

Solution

See Also

Item Details