Free DISA STIG and SRG Library | Vaulted

V-30957

The VPN gateway must use IKE main mode for the purpose of negotiating an IPSec security association policy when pre-shared keys are used for authentication

Finding ID
NET-VPN-080
Rule ID
SV-40999r1_rule
Severity
Cat III
CCE
(None)
Group Title
IKE aggressive mode is used for establishing IPSec.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Aggressive mode is completed using only three messages instead of the six used in main mode. Essentially, all the information needed to generate the Diffie-Hellman secret is exchanged in the first two messages exchanged between the two peers. The identity of the peer is also exchanged in the first two packets which have been sent in the clear. There are risks to configurations that use pre-shared keys which are exaggerated when aggressive mode is used. The entire session may be intercepted and manipulated. An adversary can either use a pre-shared key to impersonate a trusted end-point or client and connect to the protected network, or it can mount a Man-in-the-Middle attack on any new session.

Fix Text

Configure the VPN gateway to ensure aggressive mode is disabled for all IKE Phase 1 security associations.

Check Content

Examine all ISAKMP profiles configured on the VPN gateway to verify aggressive mode has not been defined for IKE Phase 1 Security Association. Aggressive mode could also be configured globally which would make it applicable to all IKE sessions.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1