The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214689	JUSX-VN-000022	SV-214689r695324_rule		Low

Description
Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session. The TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.

Description

Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session. The TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.

STIG	Date
Juniper SRX Services Gateway VPN Security Technical Implementation Guide	2021-03-25

Details

Check Text ( C-15890r695323_chk )
Ask the site representative which proposal implements Suite B. [edit] show security ike gateway View the configured options. If the dead-peer-detection is not configured, this is a finding.

Fix Text (F-15888r297655_fix)
For site-to-site VPN, configure an Internet Key Exchange (IKE) gateway that includes dead-peer-detection parameters such as in the following example. set security ike gateway IKE-PEER ike-policy IKE-POLICY set security ike gateway IKE-PEER address set security ike gateway IKE-PEER dead-peer-detection always-send set security ike gateway IKE-PEER dead-peer-detection interval 10 set security ike gateway IKE-PEER dead-peer-detection threshold 2 set security ike gateway IKE-PEER local-identity inet set security ike gateway IKE-PEER remote-identity inet Certificate> set security ike gateway IKE-PEER external-interface set security ike gateway IKE-PEER version v2-only For dynamic (remote access) VPN, the TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.

Fix Text (F-15888r297655_fix)

For site-to-site VPN, configure an Internet Key Exchange (IKE) gateway that includes dead-peer-detection parameters such as in the following example.

set security ike gateway IKE-PEER ike-policy IKE-POLICY
set security ike gateway IKE-PEER address
set security ike gateway IKE-PEER dead-peer-detection always-send
set security ike gateway IKE-PEER dead-peer-detection interval 10
set security ike gateway IKE-PEER dead-peer-detection threshold 2
set security ike gateway IKE-PEER local-identity inet
set security ike gateway IKE-PEER remote-identity inet Certificate>
set security ike gateway IKE-PEER external-interface
set security ike gateway IKE-PEER version v2-only

For dynamic (remote access) VPN, the TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.