Ensure a remote access security policy manager is used to manage the security policy on devices used for remote network connection or remote access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18590	SRC-RAP-070	SV-20136r1_rule		Medium

Description
A centralized policy manager provides a consistent security policy, particularly in environments with multiple remote access devices such as multiple VPNs or RAS devices. This is a best practice for centralized management in networks with multiple remote access gateways or products. Use a single remote access policy server or configure a centralized access server which serves this purpose.

STIG	Date
Remote Access Policy STIG	2016-03-28

Details

Check Text ( C-22224r1_chk )
Review the configuration of the remote access device (RAS/VPN). Verify the remote access policy is the primary means for configuring access control for user access. The centralized remote access policy should apply to all remote access devices so that there is a consistent security policy. Remote access portals and network extension are also handled in this access control policy. NOTE: Portal configuration and network extension configuration is handled in the access control policy.

Check Text ( C-22224r1_chk )

Review the configuration of the remote access device (RAS/VPN).

Verify the remote access policy is the primary means for configuring access control for user access. The centralized remote access policy should apply to all remote access devices so that there is a consistent security policy. Remote access portals and network extension are also handled in this access control policy.

NOTE: Portal configuration and network extension configuration is handled in the access control policy.

Fix Text (F-19223r1_fix)
Implement a centralized remote access policy for configuring and controlling access for remote users.