HPE Aruba Networking AOS Wireless Security Technical Implementation Guide

Version: 1

Updated: 07 Nov 2024

Findings: 14

Findings

V-266557 - AOS must use Transport Layer Security (TLS) 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access. (medium)
V-266559 - AOS must protect wireless access to the network using authentication of users and/or devices. (medium)
V-266560 - The network element must protect wireless access to the system using Federal Information Processing Standard (FIPS)-validated Advanced Encryption Standard (AES) block cipher algorithms with an approved confidentiality mode. (medium)
V-266577 - AOS must be configured to disable nonessential capabilities. (medium)
V-266591 - AOS must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks. (medium)
V-266627 - AOS must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication. (medium)
V-266632 - The network element must authenticate all network-connected endpoint devices before establishing any connection. (medium)
V-266639 - AOS must use cryptographic algorithms approved by the National Security Agency (NSA) to protect national security systems (NSS) when transporting classified traffic across an unclassified network. (medium)
V-266644 - AOS, in conjunction with a remote device, must prevent the device from simultaneously establishing nonremote connections with the system and communicating via some other connection to resources in external networks. (medium)
V-266703 - When AOS is used as a wireless local area network (WLAN) controller, WLAN Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) implementation must use certificate-based public key infrastructure (PKI) authentication to connect to DOD networks. (medium)
V-266704 - The site must conduct continuous wireless Intrusion Detection System (IDS) scanning. (medium)
V-266705 - AOS, when configured as a WLAN bridge, must not be configured to have any feature enabled that calls home to the vendor. (medium)
V-266707 - AOS, when used as a WLAN bridge or controller, must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface. (medium)
V-266708 - AOS wireless local area network (WLAN) service set identifiers (SSIDs) must be changed from the manufacturer's default to a pseudo random word that does not identify the unit, base, organization, etc. (low)