Juniper SRX Services Gateway VPN Security Technical Implementation Guide

The Juniper SRX Services Gateway VPN Security Technical Implementation Guide (V3 R2) has 28 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

28STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R2

CurrentPublished Thu Jan 30 2025

The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

Juniper SRX Services Gateway VPN Security Technical Implementation Guide

Assessment Title

Rule Text

The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

Description

Discussion Text

Use of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-214683

Rule

SV-214683r997555_rule

Severity

medium

Rule Version

JUSX-VN-000016

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify only IKEv2 is used for the IKE security configuration on all configured gateways. Use of IKEv1 mitigates the risk to a CAT III finding.

Show security ike gateway <VPN-GATEWAY>

If IKEv2 is not used for IKE associations, this is a finding.

Implementation Procedure

Fix Text

For site-to-site VPNs, configure the Juniper SRX to use IKEv2 only.

[edit]
set security ike gateway <VPN-GATEWAY> address <GW-IP-ADDRESS>
set security ike gateway <VPN-GATEWAY> version v2-only

STIG check 16 of 28 in the Juniper SRX Services Gateway VPN STIG checklist

← Previous · V-214682The Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.Next · V-214684 →The Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.