The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

From Juniper SRX SG VPN Security Technical Implementation Guide

Associated with: CCI-000382

SV-81151r1_rule The Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.

Vulnerability discussion

Use of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.

Check content

Verify only IKEv2 is used for the IKE security configuration on all configured gateways. Use of IKEv1 mitigates the risk to a CAT III finding. Show security ike gateway If IKEv2 is not used for IKE associations, this is a finding.

Fix text

For site-to-site VPNs, configure the Juniper SRX to use IKEv2 only. [edit] set security ike gateway address set security ike gateway version v2-only

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.