JUSX-VN-000016 - The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

Information

Use of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.

Solution

For site-to-site VPNs, configure the Juniper SRX to use IKEv2 only.

[edit]
set security ike gateway <VPN-GATEWAY> address <GW-IP-ADDRESS>
set security ike gateway <VPN-GATEWAY> version v2-only

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_SRX_SG_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, CCI|CCI-000382, CCI|CCI-004866, Rule-ID|SV-214683r997555_rule, STIG-ID|JUSX-VN-000016, STIG-Legacy|SV-81151, STIG-Legacy|V-66661, Vuln-ID|V-214683

Plugin: Juniper

Control ID: 937bb18a48659fd2dbbf5ae958f60df8ebd0c18b931539828f46014b2dd27438