JUSX-VN-000001 - The Juniper SRX Services Gateway VPN must limit the number of concurrent sessions for user accounts to one (1) and administrative accounts to three (3), or set to an organization-defined number.

800-53|AC-10

CAT|II

CCI|CCI-000054

CCI|CCI-004866

Rule-ID|SV-214668r997551_rule

STIG-ID|JUSX-VN-000001

STIG-Legacy|SV-81119

STIG-Legacy|V-66629

Vuln-ID|V-214668

JUSX-VN-000002 - The Juniper SRX Services Gateway VPN must renegotiate the IPsec security association after 8 hours or less.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-214669r856572_rule

STIG-ID|JUSX-VN-000002

STIG-Legacy|SV-81121

STIG-Legacy|V-66631

Vuln-ID|V-214669

JUSX-VN-000003 - The Juniper SRX Services Gateway VPN must renegotiate the IKE security association after 24 hours or less.

Rule-ID|SV-214670r856574_rule

STIG-ID|JUSX-VN-000003

STIG-Legacy|SV-81133

STIG-Legacy|V-66643

Vuln-ID|V-214670

JUSX-VN-000004 - The Juniper SRX Services Gateway VPN device also fulfills the role of IDPS in the architecture, the device must inspect the VPN traffic in compliance with DoD IDPS requirements.

800-53|AC-17(1)

CCI|CCI-000067

Rule-ID|SV-214671r382780_rule

STIG-ID|JUSX-VN-000004

STIG-Legacy|SV-81135

STIG-Legacy|V-66645

Vuln-ID|V-214671

JUSX-VN-000005 - The Juniper SRX Services Gateway VPN must use AES encryption for the IPsec proposal to protect the confidentiality of remote access sessions.

800-53|AC-17(2)

CAT|I

CCI|CCI-000068

CCI|CCI-004891

Rule-ID|SV-214672r997552_rule

STIG-ID|JUSX-VN-000005

STIG-Legacy|SV-80511

STIG-Legacy|V-66021

Vuln-ID|V-214672

JUSX-VN-000006 - The Juniper SRX Services Gateway VPN must use AES encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.

Rule-ID|SV-214673r997553_rule

STIG-ID|JUSX-VN-000006

STIG-Legacy|SV-81107

STIG-Legacy|V-66617

Vuln-ID|V-214673

JUSX-VN-000007 - The Juniper SRX Services Gateway VPN must implement a FIPS-140-2 validated Diffie-Hellman (DH) group.

Rule-ID|SV-214674r997554_rule

STIG-ID|JUSX-VN-000007

STIG-Legacy|SV-81137

STIG-Legacy|V-66647

Vuln-ID|V-214674

JUSX-VN-000008 - The Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA1 or greater to negotiate hashing to protect the integrity of remote access sessions.

CCI|CCI-001453

Rule-ID|SV-214675r382846_rule

STIG-ID|JUSX-VN-000008

STIG-Legacy|SV-81139

STIG-Legacy|V-66649

Vuln-ID|V-214675

JUSX-VN-000009 - The Juniper SRX Services Gateway VPN must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.

800-53|AC-4

CCI|CCI-001414

Rule-ID|SV-214676r382735_rule

STIG-ID|JUSX-VN-000009

STIG-Legacy|SV-81141

STIG-Legacy|V-66651

Vuln-ID|V-214676

JUSX-VN-000010 - The Juniper SRX Services Gateway VPN must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-214677r385561_rule

STIG-ID|JUSX-VN-000010

STIG-Legacy|SV-81109

STIG-Legacy|V-66619

Vuln-ID|V-214677

JUSX-VN-000011 - If IDPS inspection is performed separately from the Juniper SRX Services Gateway VPN device, the VPN must route sessions to an IDPS for inspection.

Rule-ID|SV-214678r864169_rule

STIG-ID|JUSX-VN-000011

STIG-Legacy|SV-81143

STIG-Legacy|V-66653

Vuln-ID|V-214678

JUSX-VN-000012 - The Juniper SRX Services Gateway VPN must not accept certificates that have been revoked when using PKI for authentication.

Rule-ID|SV-214679r385561_rule

STIG-ID|JUSX-VN-000012

STIG-Legacy|SV-81111

STIG-Legacy|V-66621

Vuln-ID|V-214679

JUSX-VN-000013 - The Juniper SRX Services Gateway VPN must specify Perfect Forward Secrecy (PFS).

Rule-ID|SV-214680r385561_rule

STIG-ID|JUSX-VN-000013

STIG-Legacy|SV-81145

STIG-Legacy|V-66655

Vuln-ID|V-214680

JUSX-VN-000014 - The Juniper SRX Services Gateway VPN must use Encapsulating Security Payload (ESP) in tunnel mode.

Rule-ID|SV-214681r385561_rule

STIG-ID|JUSX-VN-000014

STIG-Legacy|SV-81147

STIG-Legacy|V-66657

Vuln-ID|V-214681

JUSX-VN-000015 - The Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-214682r382903_rule

STIG-ID|JUSX-VN-000015

STIG-Legacy|SV-81149

STIG-Legacy|V-66659

Vuln-ID|V-214682

JUSX-VN-000016 - The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-214683r997555_rule

STIG-ID|JUSX-VN-000016

STIG-Legacy|SV-81151

STIG-Legacy|V-66661

Vuln-ID|V-214683

JUSX-VN-000017 - The Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

Rule-ID|SV-214684r385486_rule

STIG-ID|JUSX-VN-000017

STIG-Legacy|SV-81153

STIG-Legacy|V-66663

Vuln-ID|V-214684

JUSX-VN-000018 - The Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-214685r385489_rule

STIG-ID|JUSX-VN-000018

STIG-Legacy|SV-81155

STIG-Legacy|V-66665

Vuln-ID|V-214685

JUSX-VN-000019 - The Juniper SRX Services Gateway VPN must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.

800-53|IA-2(2)

CCI|CCI-000766

Rule-ID|SV-214686r954210_rule

STIG-ID|JUSX-VN-000019

STIG-Legacy|SV-81113

STIG-Legacy|V-66623

Vuln-ID|V-214686

JUSX-VN-000020 - The Juniper SRX Services Gateway VPN must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-214687r385516_rule

STIG-ID|JUSX-VN-000020

STIG-Legacy|SV-81157

STIG-Legacy|V-66667

Vuln-ID|V-214687

JUSX-VN-000021 - The Juniper SRX Services Gateway VPN must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

800-53|IA-8

CCI|CCI-000804

Rule-ID|SV-214688r385519_rule

STIG-ID|JUSX-VN-000021

STIG-Legacy|SV-81159

STIG-Legacy|V-66669

Vuln-ID|V-214688

JUSX-VN-000022 - The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

800-53|SC-10

CAT|III

CCI|CCI-001133

Rule-ID|SV-214689r971530_rule

STIG-ID|JUSX-VN-000022

STIG-Legacy|SV-81171

STIG-Legacy|V-66681

Vuln-ID|V-214689

JUSX-VN-000023 - The Juniper SRX Services Gateway VPN Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-214690r878132_rule

STIG-ID|JUSX-VN-000023

STIG-Legacy|SV-81115

STIG-Legacy|V-66625

Vuln-ID|V-214690

JUSX-VN-000024 - The Juniper SRX Services Gateway VPN IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.

Rule-ID|SV-214691r856576_rule

STIG-ID|JUSX-VN-000024

STIG-Legacy|SV-81161

STIG-Legacy|V-66671

Vuln-ID|V-214691

JUSX-VN-000025 - The Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.

800-53|SC-23

CCI|CCI-001184

Rule-ID|SV-214692r383107_rule

STIG-ID|JUSX-VN-000025

STIG-Legacy|SV-81131

STIG-Legacy|V-66641

Vuln-ID|V-214692

JUSX-VN-000026 - The Juniper SRX Services Gateway VPN must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.

800-53|SC-23(5)

CCI|CCI-002470

Rule-ID|SV-214693r856577_rule

STIG-ID|JUSX-VN-000026

STIG-Legacy|SV-81163

STIG-Legacy|V-66673

Vuln-ID|V-214693

JUSX-VN-000027 - The Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Detections

Analytics

DISA Juniper SRX Services Gateway VPN v3r1

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous