An error occurred:

Check: SRG-NET-000147-VPN-000530

Virtual Private Network (VPN) SRG: SRG-NET-000147-VPN-000530 (in versions v3 r3 through v1 r0.1)

Title

The IPsec VPN Gateway must use anti-replay mechanisms for security associations. (Cat II impact)

Discussion

Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.

Check Content

Verify the IPsec VPN Gateway uses anti-replay mechanisms for security associations. If the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.

Fix Text

Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.

Additional Identifiers

Rule ID: SV-207212r984303_rule

Vulnerability ID: V-207212

Group Title: SRG-NET-000147

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.
Number Definition
CCI-001941

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Controls

Controls tied to check. These are derived from the CCIs shown above.
Number Title
IA-2(8)

Network Access to Privileged Accounts - Replay Resistant