STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Juniper SRX Services Gateway VPN Security Technical Implementation Guide

Version

V3R2

Release Date

Dec 20, 2024

SCAP Benchmark ID

Juniper_SRX_SG_VPN_STIG

Total Checks

28

Tags

network
CAT I: 8CAT II: 20CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (28)

V-214668MEDIUMThe Juniper SRX Services Gateway VPN must limit the number of concurrent sessions for user accounts to one (1) and administrative accounts to three (3), or set to an organization-defined number.V-214669MEDIUMThe Juniper SRX Services Gateway VPN must renegotiate the IPsec security association after 8 hours or less.V-214670MEDIUMThe Juniper SRX Services Gateway VPN must renegotiate the IKE security association after 24 hours or less.V-214671MEDIUMThe Juniper SRX Services Gateway VPN device also fulfills the role of IDPS in the architecture, the device must inspect the VPN traffic in compliance with DoD IDPS requirements.V-214672HIGHThe Juniper SRX Services Gateway VPN must use AES256 for the IPsec proposal to protect the confidentiality of remote access sessions.V-214673HIGHThe Juniper SRX Services Gateway VPN must use AES256 encryption for the Internet Key Exchange (IKE) proposal to protect the confidentiality of remote access sessions.V-214674HIGHThe Juniper SRX Services Gateway VPN must be configured to use Diffie-Hellman (DH) group 15 or higher.V-214675MEDIUMThe Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA256 or greater to negotiate hashing to protect the integrity of remote access sessions.V-214676MEDIUMThe Juniper SRX Services Gateway VPN must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.V-214677HIGHThe Juniper SRX Services Gateway VPN must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).V-214678MEDIUMIf IDPS inspection is performed separately from the Juniper SRX Services Gateway VPN device, the VPN must route sessions to an IDPS for inspection.V-214679HIGHThe Juniper SRX Services Gateway VPN must not accept certificates that have been revoked when using PKI for authentication.V-214680MEDIUMThe Juniper SRX Services Gateway VPN must specify Perfect Forward Secrecy (PFS).V-214681MEDIUMThe Juniper SRX Services Gateway VPN must use Encapsulating Security Payload (ESP) in tunnel mode.V-214682MEDIUMThe Juniper SRX Services Gateway must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.V-214683MEDIUMThe Juniper SRX Services Gateway VPN must use IKEv2 for IPsec VPN security associations.V-214684MEDIUMThe Juniper SRX Services Gateway VPN must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-214685MEDIUMThe Juniper SRX Services Gateway VPN must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-214686HIGHThe Juniper SRX Services Gateway VPN must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.V-214688MEDIUMThe Juniper SRX Services Gateway VPN must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-214689MEDIUMThe Juniper SRX Services Gateway VPN must terminate all network connections associated with a communications session at the end of the session.V-214690HIGHThe Juniper SRX Services Gateway VPN Internet Key Exchange (IKE) must be configured to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.V-214691MEDIUMThe Juniper SRX Services Gateway VPN IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.V-214692HIGHThe Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.V-214693MEDIUMThe Juniper SRX Services Gateway VPN must only allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.V-214694MEDIUMThe Juniper SRX Services Gateway VPN must only allow incoming VPN communications from organization-defined authorized sources routed to organization-defined authorized destinations.V-214695MEDIUMThe Juniper SRX Services Gateway VPN must disable split-tunneling for remote clients VPNs.V-214696MEDIUMThe Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.