The firewall implementation must use approved cryptography to protect the confidentiality of remote access sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000062-FW-000044	SRG-NET-000062-FW-000044	SRG-NET-000062-FW-000044_rule		High

Description
Remote access services enable users outside of the enclave (external interface) to have access to data and services within the private network. In many instances these connections traverse the Internet. Remote access sessions must use encryption to protect the confidentiality of information traveling through a public network such as the Internet. Requiring remote access sessions to the enclave to traverse an encrypted tunnel, authorized on a per client basis, makes the session difficult to snoop or spoof.

Description

Remote access services enable users outside of the enclave (external interface) to have access to data and services within the private network. In many instances these connections traverse the Internet. Remote access sessions must use encryption to protect the confidentiality of information traveling through a public network such as the Internet. Requiring remote access sessions to the enclave to traverse an encrypted tunnel, authorized on a per client basis, makes the session difficult to snoop or spoof.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000062-FW-000044_chk )
Examine all Internet Security Association and Key Management Protocol (ISAKMP) and IPSec policies configured on the firewall. Determine what encryption algorithm is used for establishing security associations. If an approved cryptography such as AES is not used to protect the confidentiality of remote access sessions, this is a finding.

Fix Text (F-SRG-NET-000062-FW-000044_fix)
Configure all ISAKMP and IPSec policies to use AES for establishing security associations to protect the confidentiality of remote access sessions.