The VPN gateway must use ESP tunnel mode for establishing secured paths to transport traffic between the organization’s sites or between a gateway and remote end-stations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30964	NET-VPN-150	SV-41006r1_rule	ECSC-1	High

Description
Encapsulating Security Payload (ESP) is the feature in the IPSec architecture providing confidentiality, data origin authentication, integrity, and anti-replay services. ESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPSec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted; whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPSec gateways, or between an IPSec gateway and an end-station running IPSec software. Hence, it is the only method to provide secured path to transport traffic between remote sites or end-stations and the central site.

Description

Encapsulating Security Payload (ESP) is the feature in the IPSec architecture providing confidentiality, data origin authentication, integrity, and anti-replay services. ESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPSec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted; whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPSec gateways, or between an IPSec gateway and an end-station running IPSec software. Hence, it is the only method to provide secured path to transport traffic between remote sites or end-stations and the central site.

STIG	Date
IPSec VPN Gateway Security Technical Implementation Guide	2016-09-28

Details

Check Text ( C-39624r2_chk )
Review all transform sets defined in IPSec profiles and crypto maps and verify ESP tunnel mode has been specified. If the mode is not configured, determine the default for the VPN gateway.

Fix Text (F-34774r1_fix)
Configure all IPSec transform sets to use ESP tunnel mode.