The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30957	NET-VPN-080	SV-40999r1_rule	ECSC-1	Low

Description
Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity of the peer is also exchanged in the first two packets which have been sent in the clear. There are risks to configurations that use pre-shared keys which are exaggerated when aggressive mode is used. The entire session may be intercepted and manipulated. An adversary can either use a pre-shared key to impersonate a trusted end-point or client and connect to the protected network, or it can mount a Man-in-the-Middle attack on any new session.

Description

Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity of the peer is also exchanged in the first two packets which have been sent in the clear. There are risks to configurations that use pre-shared keys which are exaggerated when aggressive mode is used. The entire session may be intercepted and manipulated. An adversary can either use a pre-shared key to impersonate a trusted end-point or client and connect to the protected network, or it can mount a Man-in-the-Middle attack on any new session.

STIG	Date
IPSec VPN Gateway Security Technical Implementation Guide	2018-03-08

Details

Check Text ( C-39617r2_chk )
Examine all ISAKMP profiles configured on the VPN gateway to verify aggressive mode has not been defined for IKE Phase 1 Security Association. Aggressive mode could also be configured globally which would make it applicable to all IKE sessions.

Fix Text (F-34767r2_fix)
Configure the VPN gateway to ensure aggressive mode is disabled for all IKE Phase 1 security associations.