HPE Aruba Networking AOS VPN Security Technical Implementation Guide

The HPE Aruba Networking AOS VPN Security Technical Implementation Guide (V1 R2) has 21 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

21STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Sep 30 2026

The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).

HPE Aruba Networking AOS VPN Security Technical Implementation Guide

Assessment Title

Rule Text

The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Forwarding (L2F).

Description

Discussion Text

PPTP and L2F are obsolete methods for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-266998

Rule

SV-266998r1040760_rule

Severity

medium

Rule Version

ARBA-VN-000470

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the AOS configuration with the following commands:
show ip access-list vpnlogon
show firewall-cp

If PPTP or TCP 1723 are permitted, this is a finding.

Implementation Procedure

Fix Text

Configure AOS with the following commands:
configure terminal
cd /mm
ip access-list session vpnlogon
any any svc-pptp deny
exit
write memory
cd /mynode
firewall cp
ipv4 deny any proto 6 ports 1723 1723
ipv6 deny any proto 6 ports 1723 1723
exit
write memory

STIG check 17 of 21 in the HPE Aruba Networking AOS VPN STIG checklist

← Previous · V-266997AOS, when used as a VPN Gateway, must renegotiate the security association after 24 hours or less or as defined by the organization.Next · V-266999 →AOS, when used as a VPN Gateway, must be configured to route sessions to an intrusion detection and prevention system (IDPS) for inspection.