The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

From Juniper SRX SG VPN Security Technical Implementation Guide

Part of SRG-NET-000213

Associated with: CCI-001133

SV-81171r1_rule The Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.

Vulnerability discussion

Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.The TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.

Check content

Ask the site representative which proposal implements Suite B. [edit] show security ike gateway View the configured options. If the dead-peer-detection is configured, this is a finding.

Fix text

For site-to-site VPN, configure an Internet Key Exchange (IKE) gateway that includes dead-peer-detection parameters such as in the following example. set security ike gateway IKE-PEER ike-policy IKE-POLICY set security ike gateway IKE-PEER address set security ike gateway IKE-PEER dead-peer-detection always-send set security ike gateway IKE-PEER dead-peer-detection interval 10 set security ike gateway IKE-PEER dead-peer-detection threshold 2 set security ike gateway IKE-PEER local-identity inet set security ike gateway IKE-PEER remote-identity inet set security ike gateway IKE-PEER external-interface set security ike gateway IKE-PEER version v2-only For dynamic (remote access) VPN, the TCP keep-alive for remote access is implemented in the Juniper SRX Firewall STIG.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer