V1R2 changes
HPE Aruba Networking AOS VPN STIG V1R2 (2026-09-30) replaced V1R1 (2024-10-22): 9 checks updated. It has 21 checks, against 21 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 0 added
- 0 removed
- 9 updated
Updated fields: Discussion 6Fix text 3Check text 2Title 1
Updated in V1R2 (9)
V-266983CAT IIAOS, when used as a VPN Gateway, must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.Discussion
Discussion
Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.
SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. DODDoW systems must not be configured to use SHA-1 for integrity of remote access sessions.
The remote access VPN provides access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network.
Satisfies: SRG-NET-000063-VPN-000220, SRG-NET-000074-VPN-000250, SRG-NET-000168-VPN-000600, SRG-NET-000230-VPN-000780
V-266984CAT IIAOS, when used as a VPN Gateway and using public key infrastructure (PKI)-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.Check text, Discussion
Check text
1. Verify the AOS configuration with the following command:
show crypto-local pki trusted CA
2. Note the name(s) of each trust CA.
show crypto-local pki trustedCA <name>
3. Verify that each trusted CA is a valid DODDoW PKI CA.
If the trusted CAs are not DODDoW PKI or no DODDoW PKI CAs are present, this is a finding.
Discussion
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.
A trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and Domain Name System Security Extensions (DNSSEC). However, applications that do not use a trusted path are not approved for nonlocal and remote management of DODDoW information systems.
Use of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved because they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.
When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a certificate authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.
This requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.
V-266985CAT IAOS, when used as an IPsec VPN Gateway, must use Advanced Encryption Standard (AES) encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.Discussion
Discussion
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network.
AES is the Federal Information Processing Standard (FIPS)-validated cipher block cryptographic algorithm approved for use in DODDoW. For an algorithm implementation to be listed on a FIPS 140-2/140-3 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2/140-3 and must successfully complete the cryptographic algorithm validation process. Currently, the National Institute of Standards and Technology (NIST) has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.
Satisfies: SRG-NET-000317-VPN-001090, SRG-NET-000371-VPN-001650, SRG-NET-000400-VPN-001940, SRG-NET-000525-VPN-002330
V-266986CAT IIAOS, when used as a VPN Gateway, must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.Fix text
Fix text
Configure AOS with the following commands:
1. crypto pki csr ec curve_name secp384r1 common_name <common_name> country <US> state_or_province <state> city <city> organization <org> unit <unit> email <email>
show crypto pki csr
2. Use DODDoW PKI to generate a public certificate based on the CSR.
3. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates.
4. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, "ServerCert" type, and click "Submit".
5. Navigate to Configuration >> System >> Admin and choose the imported certificate under "Server Certificate" and click "Submit".
6. Click Pending Changes >> Deploy Changes.
configure terminal
crypto ipsec transform-set <name> esp-aes256-gcm
crypto isakmp policy <#>
authentication ecdsa-384
encryption aes256
group 20
hash sha2-384-192
prf prf-hmac-sha384
version v2
exit
crypto-local ipsec-map <name> <priority>
set transform-set <set created earlier name>
<configure VPN settings as needed>
exit
write memory
V-266989CAT IIThe Remote Access VPN Gateway and/or client must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the network.Title, Check text, Discussion
Title
The Remote Access VPN Gateway and/or client must display the Standard Mandatory DODoW Notice and Consent Banner before granting remote access to the network.
Check text
Verify the AOS configuration with the following command:
show bannervia
If the Standard Mandatory DODoW Notice and Consent Banner is not set, this is a finding.
Discussion
Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
In most VPN implementations, the banner is configured in the management backplane (NDM Security Requirements Guide) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.
The banner must be formatted in accordance with applicable DODDoW policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:
"I've read & consent to terms in IS user agreem't."
Satisfies: SRG-NET-000041-VPN-000110, SRG-NET-000042-VPN-000120, SRG-NET-000043-VPN-000130
V-266994CAT IIThe Remote Access VPN Gateway must use a separate authentication server (e.g., Lightweight Directory Access Protocol [LDAP], Remote Authentication Dial-In User Service [RADIUS], Terminal Access Controller Access-Control System+ [TACACS+] to perform user authentication.Fix text
Fix text
Configure AOS with the following commands:
1. crypto pki csr ec curve_name secp384r1 common_name <common_name> country <US> state_or_province <state> city <city> organization <org> unit <unit> email <email>
show crypto pki csr
2. Use DODDoW PKI to generate a public certificate based on the CSR.
3. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates.
4. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, select Certificate type: "ServerCert", and click "Submit".
5. Click Pending Changes >> Deploy Changes.
Continue configuring with the CLI:
configure terminal
crypto-local isakmp ca-certificate <CA certificate name>
crypto-local isakmp certificate-group server-certificate <EC certificate name> ca-certificate <CA certificate name>
write memory
crypto dynamic-map <name> <priority>
version v2
set pfs group20
set transform-set default-gcm256
set security-association lifetime seconds 28800
exit
write memory
aaa authentication-server radius <name>
host <A.B.C.D or X:X:X:X::X or hostname>
key <preshared key>
enable
exit
write memory
aaa server-group <name>
auth-server <name>
exit
write memory
ip access-list session <name>
any any any permit
ipv6 any any any permit
exit
write memory
user-role <name>
access-list session <name>
exit
write memory
aaa authentication via auth-profile <name>
default-role <name>
client-cert-enable
server-group <name>
exit
write memory
aaa authentication via connection-profile <name>
auth-profile <name>
enable-fips
ikev2-policy 10009
ikev2-proto
ikev2auth eap-tls
ipsecv2-cryptomap map <name> number <priority>
max-timeout value <0-65535>
suiteb-crypto
validate-server-cert
exit
write memory
aaa authentication via web-auth default
auth-profile <name>
exit
write memory
user-role <name>
via <name>
exit
write memory
V-266995CAT IIThe VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).Fix text
Fix text
Configure AOS with the following commands:
1. crypto pki csr ec curve_name secp384r1 common_name <common_name> country <US> state_or_province <state> city <city> organization <org> unit <unit> email <email>
show crypto pki csr
2. Use DODDoW PKI to generate a public certificate based on the CSR.
3. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates.
4. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, select Certificate type: "ServerCert", and click "Submit".
5. Click Pending Changes >> Deploy Changes.
Continue configuring with the CLI:
configure terminal
crypto-local isakmp ca-certificate <CA certificate name>
crypto-local isakmp certificate-group server-certificate <EC certificate name> ca-certificate <CA certificate name>
write memory
crypto dynamic-map <name> <priority>
version v2
set pfs group20
set transform-set default-gcm256
set security-association lifetime seconds 28800
exit
write memory
aaa authentication-server radius <name>
host <A.B.C.D or X:X:X:X::X or hostname>
key <preshared key>
enable
exit
write memory
aaa server-group <name>
auth-server <name>
exit
write memory
ip access-list session <name>
any any any permit
ipv6 any any any permit
exit
write memory
user-role <name>
access-list session <name>
exit
write memory
aaa authentication via auth-profile <name>
default-role <name>
client-cert-enable
server-group <name>
exit
write memory
aaa authentication via connection-profile <name>
auth-profile <name>
enable-fips
ikev2-policy 10009
ikev2-proto
ikev2auth eap-tls
ipsecv2-cryptomap map <name> number <priority>
max-timeout value <0-65535>
suiteb-crypto
validate-server-cert
exit
write memory
aaa authentication via web-auth default
auth-profile <name>
exit
write memory
user-role <name>
via <name>
exit
write memory
V-266996CAT IIThe Remote Access VPN Gateway must terminate remote access network connections after an organization-defined time period.Discussion
Discussion
This requirement is in response to the DODDoW Office of Inspector General Audit of Maintaining Cybersecurity in the Coronavirus Disease-2019 Telework Environment.
Best practice is to terminate inactive user sessions after a period; however, when setting timeouts to any VPN connection, the organization must consider the risk to the mission and the purpose of the VPN. VPN connections that provide user access to the network are the prime candidates for VPN session termination and are the primary focus of this requirement.
To determine if and when the VPN connections warrant termination, the organization must perform a risk assessment to identify the use case for the VPN and determine if periodic VPN session termination puts the mission at significant risk.
The organization must document the results and the determination of the risk assessment in the VPN section of the System Security Plan. The organization must also configure VPN session terminations in accordance with the risk assessment.
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. Quickly terminating an idle session will also free up resources committed by the managed network element.
Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection.
This requirement applies to any network element that tracks individual sessions (e.g., stateful inspection firewall, ALG, or VPN).
V-266999CAT IIAOS, when used as a VPN Gateway, must be configured to route sessions to an intrusion detection and prevention system (IDPS) for inspection.Discussion
Discussion
Remote access devices, such as those providing remote access to network devices and information systems, that lack automated capabilities increase risk and make remote user access management difficult at best.
Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network.
Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities from a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.