Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-66661 | JUSX-VN-000016 | SV-81151r1_rule | Medium |
| Description |
|---|
| Use of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms. |
| STIG | Date |
|---|---|
| Juniper SRX SG VPN Security Technical Implementation Guide | 2017-10-03 |
Details
| Check Text ( C-67287r1_chk ) |
|---|
| Verify only IKEv2 is used for the IKE security configuration on all configured gateways. Use of IKEv1 mitigates the risk to a CAT III finding. Show security ike gateway If IKEv2 is not used for IKE associations, this is a finding. |
| Fix Text (F-72737r1_fix) |
|---|
| For site-to-site VPNs, configure the Juniper SRX to use IKEv2 only. [edit] set security ike gateway set security ike gateway |