The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication

From IPSec VPN Gateway Security Technical Implementation Guide

Part of IKE aggressive mode is used for establishing IPSec.

Associated with IA controls: ECSC-1

SV-40999r1_rule The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication

Vulnerability discussion

Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity of the peer is also exchanged in the first two packets which have been sent in the clear. There are risks to configurations that use pre-shared keys which are exaggerated when aggressive mode is used. The entire session may be intercepted and manipulated. An adversary can either use a pre-shared key to impersonate a trusted end-point or client and connect to the protected network, or it can mount a Man-in-the-Middle attack on any new session.

Check content

Examine all ISAKMP profiles configured on the VPN gateway to verify aggressive mode has not been defined for IKE Phase 1 Security Association. Aggressive mode could also be configured globally which would make it applicable to all IKE sessions.

Fix text

Configure the VPN gateway to ensure aggressive mode is disabled for all IKE Phase 1 security associations.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.