Solved

PCI compliance scanning with Juniper network=s application acceleration Platform (VPN)

Posted on 2016-10-05
7
111 Views
Last Modified: 2016-10-17
We have to do compliance scanning now going forward every quarter and w do have 3 users that have the juniper vpn  installed on their local computer.  This is causing us to fail along with the following other problems.   Any advice to clear these failures would be appreciated:
1. We have an ASA 5505 and we are getting the following problem, that I think is being caused by the lack of a ssl certificate on the ASA??Not sure.  but the failure description is:  An SSL cert associates an entity (person ,ORG, host, etc) with a public Key.  In and SSL connection Client Autheticates the server's cert and extracts the public Key in the cert to establish the secure connection.  
So the question is where do they want a cert?.  I can't put it on the ASA and it doesn't make sense to put it on the 3 users computers that use the Juniper VPN.   Is this happening because the Juniper VPN is not the latest version?

2.  Anothewr failure is labled Pre-shared key off-line bruteforcing using IKE aggressive Mode (CVE-2002-1623)

3. Lst problem is  again related the the Juniper VPN and port 500/udp.  IDE is used during Phase 1 and Phase 2 of the establishing connection.  Phse 1 the two ISAKMP peers establish a secure authenticated channel which to communicate.  Every participant in the IKE must possess a key that my be rather pre-shared or Publickey.  There are inherent risks to configurations that use pre-shared keys which ar exaggerated when aggressive mode is used.
0
Comment
Question by:barl009
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 41831029
1. Should be setting up certificate check for the vpn client with the ASA. See example
http://www.networkworld.com/article/2227087/cisco-subnet/how-to-guide--cisco-asa-sslvpn-using-certificates-for-2-factor-auth.html

2/3. IKE can use Main mode or Aggressive mode. If you get your devices to use Main mode rather than Aggressive mode you mitigate the issue. Some simply disable the aggresive mode inbound with the command "crypto ikev1 am-disable" on cisco ASA platform.

Also the vulnerability is the length and strength of your key. From 8-16 characters alphanumeric is a fairly strong key. If you are concerned and want to better mitigate the vulnerability then increase the length of the key and/or improve the strength of the key.

See this

https://supportforums.cisco.com/discussion/10173301/pre-shared-key-line-bruteforcing-using-ike-aggressive-mode
0
 

Author Comment

by:barl009
ID: 41831753
this sounds good, have to analyze each white paper.  Have to get help to implement.  So for 1.  Just to clarify, you want me to put a $300 cert on the three workstations that use this Juniper client?  or just a self created cert in the ASA?  
I am sending this off to my consultant company as they had not a good answer for this.  these articles seem very explicit and valuable.
Thank you.
0
 
LVL 63

Expert Comment

by:btan
ID: 41831809
I dont suggest self sign certificate but it is up to your company business decision. Having cert that is issued by CA will be of higher assurance than self signed. Furthermore self signed cert are not in the list of trusted CA though you can still manually import to get pass with trust chain check and warning.
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:barl009
ID: 41832011
So can a issued CA be put on the CISCO ASA?  And if so where can I find the steps?
0
 
LVL 63

Expert Comment

by:btan
ID: 41832137
No problem - see my last post URL
Configure a trusted identity certificate on your ASA. It is important that you use an identity certificate from a trusted CA source for your ASA. An ASA identity certificate is the certificate that the ASA will hand out to the sslvpn clients that connect to it. In order for everything to work correctly the certificate must match the ASA hostname/IP address. Also, the end-users client must trust the CA that generated the ASA's identity certificate. A self-signed or other non-trusted CA cert is fine for testing but not for production.


Within ASDM you can sign up for a special promo certificate from Entrust if you'd like but any trusted public CA will do the trick. To configure the identity certificate on your ASA do the following:

1)      First obtain your identity certificate. Make sure it is in PKCS12 format. Also, be sure it includes the complete certificate chain.

2)      Go to Configuration > Remote Access VPN > Certificate Management > Identity Certificates. Click Add.

3)      If your ASA will be in DNS then you can use the FQDN as the identifier in the certificate. If it will not be in DNS (only during testing, for production it must be in DNS) then be sure to use the IP address as the identifier.

4)      That's it your done! However, if you need to do it the hard way by using a certificate signing request then proceed to setups 5 through end below.

5)      If you need to generate a certificate signing request from the ASA then instead of doing step 2 do the below instead.
0
 

Author Comment

by:barl009
ID: 41836811
ok
0
 

Author Closing Comment

by:barl009
ID: 41846663
Thank you
0

Featured Post

RoboForm Secure Password Management System

RoboForm Everywhere - Superb Browser Support
Windows / Apple / IOS / Android / Linux / Chrome OS
Use different complex passwords everywhere
Best Secure Password Management by far
Synchronize all of your devices instantly
Safe, Secure & Highly Recommended!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Ransomware is a malware that is again in the list of security  concerns. Not only for companies, but also for Government security and  even at personal use. IT departments should be aware and have the right  knowledge to how to fight it.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question