What changed in HPE Aruba Networking AOS Wireless STIG V1R3V1R3 changes

Discussion

Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. This requirement applies to TLS gateways (also known as Secure Sockets Layer [SSL] gateways). Application protocols such as Hypertext Transfer Protocol Secure (HTTPS), Secure File Transfer Protocol (SFTP), and others use TLS as the underlying security protocol and thus are in scope for this requirement. National Institute of Standards and Technology (NIST) Special Publication 800-52 provides guidance for client negotiation on either DODDoW-only or public-facing servers. Satisfies: SRG-NET-000062, SRG-NET-000530

V-266557 in V1R3

Check text

Verify the AOS configuration with the following command: show wlan ssid-profile For each WLAN SSID: show wlan ssid-profile &ltSSID profile name> If a WPA Passphrase is set or if Encryption is not set with wpa2-aes or wpa3-cnsa, this is a finding.

Fix text

Configure AOS with the following commands: configure terminal wlan ssid-profile &ltprofile name> opmode &ltwpa2-aes or wpa3-cnsa> exit write memory

Discussion

Allowing devices and users to connect to the system without first authenticating them allows untrusted access and can lead to a compromise or attack. The security boundary of a wireless local area network (WLAN) extends from the client device to the network boundary where network access is controlled. This boundary represents the portion of the network most vulnerable to attack and must be protected. Within this boundary there must be two distinct, but related, security protection mechanisms: authentication and data-in-transit encryption. These protections ensure access control and protection from eavesdropping for both the WLAN system and the DODDoW network enclave. Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., Extensible Authentication Protocol (EAP)/Transport Layer Security (TLS) and Protected EAP [PEAP]), which provide credential protection and mutual authentication. Satisfies: SRG-NET-000069, SRG-NET-000070

V-266559 in V1R3

Discussion

Allowing devices and users to connect to the system without first authenticating them allows untrusted access and can lead to a compromise or attack. Because wireless communications can be intercepted, encryption must be used to protect the confidentiality of information in transit. Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., Extensible Authentication Protocol (EAP)/Transport Layer Security (TLS) and Protected EAP [PEAP]), which provide credential protection and mutual authentication. This requirement applies to operating systems that control wireless devices. A block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication. AES is the FIPS-validated cipher block cryptographic algorithm approved for use in the DODDoW. For an algorithm implementation to be listed on a FIPS 140-2/140-3 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2/140-3 and must successfully complete the cryptographic algorithm validation process. Currently, the National Institute of Standards and Technology (NIST) has approved the following confidentiality modes to be used with AES: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW. Satisfies: SRG-NET-000070, SRG-NET-000151

V-266560 in V1R3

Fix text

Configure AOS using the web interface: 1. Navigate to Configuration >> Services >> VPN and expand "Site-to-Site". 2. Select the configured site-to-site VPN IPsec maps. Select the applicable Server certificate. Select the applicable trusted DODDoW root CA under "CA certificate:". 3. Click Submit >> Pending Changes >> Deploy Changes. 4. Navigate to Configuration >> Access Points >> Remote APs tab. 5. Select the check box next to the AP Name in the Remote AP table and click "Provision". 6. In the "General" tab, select "Certificate" from the "Authentication method:" drop-down list. 7. Click "Submit" to apply the configuration and reboot the AP as a certificate Remote AP. 8. Click Pending Changes >> Deploy Changes.

V-266632 in V1R3

Fix text

Configure AOS with the following commands: crypto pki csr ec curve_name secp384r1 common_name &ltcommon_name> country &ltUS> state_or_province &ltstate> city &ltcity> organization &ltorg> unit &ltunit> email &ltemail> show crypto pki csr 1. Use DODDoW PKI to generate a public certificate based on the CSR. 2. Using the web GUI, navigate to Configuration >> System >> Certificates >> Import Certificates. 3. Click the plus sign (+) and enter "Certificate name:", browse to the public certificate file, choose the appropriate format, "ServerCert" type, and click "Submit". 4. Navigate to Configuration >> System >> Admin, choose the imported certificate under "Server Certificate", and click "Submit". 5. Click Pending Changes >> Deploy Changes. configure terminal crypto ipsec transform-set &ltname> esp-aes256-gcm crypto isakmp policy &lt#> authentication ecdsa-384 encryption aes256 group 20 hash sha2-384-192 prf prf-hmac-sha384 version v2 exit crypto-local ipsec-map &ltname> &ltpriority> set transform-set &ltset created earlier name> &ltconfigure VPN settings as needed> exit write memory

V-266639 in V1R3

Title

When AOS is used as a wireless local area network (WLAN) controller, WLAN Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) implementation must use certificate-based public key infrastructure (PKI) authentication to connect to DODDoW networks.

Check text

Verify the AOS configuration using the web interface: 1. Navigate to Configuration >> WLANs and select the desired WLAN in the WLANs field. 2. Under the selected WLAN, select "Security". Note which Auth servers are configured. 3. Navigate to Configuration >> Authentication. 4. In the "All Servers" field, select each WLAN authentication server noted earlier. 5. Verify each configured authentication server is configured to support EAP-TLS with DODDoW PKI. If each WLAN authentication server is not configured to support EAP-TLS with DODDoW PKI, this is a finding.

Discussion

DODDoW certificate-based PKI authentication is strong, two-factor authentication that relies on carefully evaluated cryptographic modules. Implementations of EAP-TLS that are not integrated with certificate-based PKI could have security vulnerabilities. For example, an implementation that uses a client certificate on a laptop without a second factor could enable an adversary with access to the laptop to connect to the WLAN without a PIN or password. Systems that do not use the certificate-based PKI are also much more likely to be vulnerable to weaknesses in the underlying public key infrastructure (PKI) that supports EAP-TLS. Certificate-based PKI authentication must be used to connect WLAN client devices to DODDoW networks. The certificate-based PKI authentication should directly support the WLAN EAP-TLS implementation. At least one layer of user authentication must enforce network authentication requirements (e.g., CAC authentication) before the user is able to access DODDoW information resources.

V-266703 in V1R3

Fix text

Configure AOS using the web interface: 1. To provision access points as dedicated air monitors to perform continuous WIDS scanning, navigate to Configuration >> AP Groups. 2. Click on the "+" sign to add a new AP group. 3. Name the group. 4. Select the created group. 5. Click on "Radio". Change each Radio mode to "am-mode".   6. Click Submit >> Pending Changes >> Deploy Changes. 7. Navigate to "Access Points". 8. Select "Allowlist". 9. Configure the desired access points as air monitors by provisioning them to the AP group created earlier. 10. Click Submit >> Pending Changes >> Deploy Changes. Note: Access points in ap-mode perform WIDS scanning between processing client data packets. Air monitors do not advertise WLANs or handle client data.

Discussion

DODDoW networks are at risk and DODDoW data could be compromised if wireless scanning is not conducted to identify unauthorized wireless local area network (WLAN) clients and access points connected to or attempting to connect to the network. DODDoW Components must ensure that a wireless intrusion detection system (WIDS) is implemented that allows for monitoring of WLAN activity and the detection of WLAN-related policy violations on all unclassified and classified DODDoW wired and wireless LANs. The WIDS must be implemented regardless of whether or not an authorized WLAN has been deployed. The WIDS must be capable of monitoring IEEE 802.11 transmissions within all DODDoW LAN environments and detecting nearby unauthorized WLAN devices. The WIDS is not required to monitor non-IEEE 802.11 transmissions. The WIDS must continuously scan for and detect authorized and unauthorized WLAN activities 24 hours a day, seven days a week. Note: Exceptions to WIDS implementation criteria may be made by the authorizing official (AO) for DODDoW wired and wireless LAN operating environments. This exception allows the AO to implement periodic scanning conducted by designated personnel using hand-held scanners during walkthrough assessments. Periodic scanning may be conducted as the alternative to the continuous scanning only in special circumstances, where it has been determined on a case-by-case basis that continuous scanning is either infeasible or unwarranted. The AO exception must be documented. The "infeasible" criteria includes the following use case examples: - It is not my building - This scenario means that for contractual or other similar reasons, the DODDoW component is not allowed to install a WIDS. - There is no power or space is limited - This scenarios means that for space, weight, and power (SWAP) reasons, the addition of continuous scanning capabilities cannot be accomplished because it would exceed SWAP availability. Power would also affect the decision to waive continuous scanning requirements if the entire LAN is only in operation periodically (e.g., the wired/wireless LAN is enabled on a vehicle that is only operating when the vehicle is being used for a specific operation). - The exception for "Minimal Impact WLAN Systems" that do not provide connectivity to WLAN-enabled PEDs (e.g., backhaul systems), have no available FIPS 140-validated 802.1X EAP-TLS supplicant, support a very small number of users for a specific mission (e.g., 10 or less users), are standalone networks, or are highly specialized WLAN systems that are isolated from the DODINDOWIN (e.g., hand-held personal digital assistants [PDAs] used as radio-frequency identification [RFID] readers, a network of WLAN-enabled Voice over Internet Protocol [VoIP] phones) allows the AO to waive any of the security requirements in the Instruction. This includes using nonstandard/proprietary FIPS-validated encryption, using an alternative FIPS-validated EAP type, and not having a continuous WIDS. - The cost of the continuous WIDS capability is more expensive that the total cost of the LAN without a WIDS. The AO must conduct a wireless threat risk assessment where analysis has shown that the threat environment is extremely unlikely to nonexistent to meet the "unwarranted" exception criteria.

V-266704 in V1R3