STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 6 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Juniper SRX SG VPN Security Technical Implementation Guide

Archived

Version

V1R2

Release Date

Oct 27, 2017

SCAP Benchmark ID

S-b57ec49509f16756d0a877114eb5cdfc0a81fc85

Total Checks

29

Tags

network
CAT I: 7CAT II: 21CAT III: 1

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (29)

V-66021HIGHThe Juniper SRX Services Gateway VPN must use AES encryption for the IPsec proposal to protect the confidentiality of remote access sessions.V-66617HIGHThe Juniper SRX Services Gateway VPN must use AES encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.V-66619HIGHThe Juniper SRX Services Gateway VPN must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).V-66621HIGHThe Juniper SRX Services Gateway VPN must not accept certificates that have been revoked when using PKI for authentication.V-66623HIGHThe Juniper SRX Services Gateway VPN must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.V-66625HIGHThe Juniper SRX Services Gateway VPN Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.V-66629MEDIUMThe Juniper SRX Services Gateway VPN must limit the number of concurrent sessions for user accounts to one (1) and administrative accounts to three (3), or set to an organization-defined number.V-66631MEDIUMThe Juniper SRX Services Gateway VPN must renegotiate the security association after 8 hours or less.V-66641HIGHThe Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.V-66643MEDIUMThe Juniper SRX Services Gateway VPN must renegotiate the security association after 24 hours or less.V-66645MEDIUMThe Juniper SRX Services Gateway VPN device also fulfills the role of IDPS in the architecture, the device must inspect the VPN traffic in compliance with DoD IDPS requirements.V-66647MEDIUMThe Juniper SRX Services Gateway VPN must implement a FIPS-140-2 validated Diffie-Hellman (DH) group.V-66649MEDIUMThe Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA1 or greater to negotiate hashing to protect the integrity of remote access sessions.V-66651MEDIUMThe Juniper SRX Services Gateway VPN must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.V-66653MEDIUMIf IDPS inspection is performed separately from the Juniper SRX Services Gateway VPN device, the VPN must route sessions to an IDPS for inspection.V-66655MEDIUMThe Juniper SRX Services Gateway VPN must specify Perfect Forward Secrecy (PFS).V-66657MEDIUMThe Juniper SRX Services Gateway VPN must use Encapsulating Security Payload (ESP) in tunnel mode.V-66659MEDIUMThe Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.V-66661MEDIUMThe Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.V-66663MEDIUMThe Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-66665MEDIUMThe Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-66667MEDIUMThe Juniper SRX Services Gateway VPN must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.V-66669MEDIUMThe Juniper SRX Services Gateway VPN must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-66671MEDIUMThe Juniper SRX Services Gateway VPN IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.V-66673MEDIUMThe Juniper SRX Services Gateway VPN must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.V-66675MEDIUMThe Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations.V-66677MEDIUMThe Juniper SRX Services Gateway VPN must disable split-tunneling for remote clients VPNs.V-66679MEDIUMThe Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.V-66681LOWThe Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.