Configure the IPSec VPN gateway for the main mode with digital certificates for secure negotiation of the communications channel, including compliant settings for key exchange and authentication of both ends of the channel.

Part of SRC-VPN-040 IPSec VPN mode and IKE settings

Associated with IA controls: ECSC-1

SV-23850r1_rule Configure the IPSec VPN gateway for the main mode with digital certificates for secure negotiation of the communications channel, including compliant settings for key exchange and authentication of both ends of the channel.

Vulnerability discussion

This configuration will ensure secure negotiation of a secure channel including key exchange, and authentication of both ends resulting in a secure connection over which other IPSec communications can occur.

Check content

Inpect the configuration by viewing the VPN configuration screen in the management workstaion. Verify the VPN attributes are compliant. NOTE: The channel will be configured for phase one IKE exchange type. Additionally the following have not been configured: FIPS 140-2 encryption algorithm (e.g., AES); Integrity protection algorithm is FIPS compliant (e.g., HMAC-SHA-1); and the Authentication method will be digital signatures or PKI.

Fix text

Ensure tthe IPSEC VPN is configured as requried by the policy.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.