documentation_complete: true

prodtype: rhel7,fedora

title: 'Verify Any Configured IPSec Tunnel Connections'

description: |-
    Libreswan provides an implementation of IPsec
    and IKE, which permits the creation of secure tunnels over
    untrusted networks. As such, IPsec can be used to circumvent certain
    network requirements such as filtering. Verify that if any IPsec connection
    (<tt>conn</tt>) configured in <tt>/etc/ipsec.conf</tt> and <tt>/etc/ipsec.d</tt>
    exists is an approved organizational connection.

rationale: 'IP tunneling mechanisms can be used to bypass network filtering.'

severity: medium

identifiers:
    cce@rhel7: 80171-2

references:
    disa: 336
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: AC-4
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040820"

ocil_clause: 'the IPSec tunnels are not approved'

ocil: |-
    To check for configured IPsec connections (<tt>conn</tt>), perform the following:
    <pre>grep -rni conn /etc/ipsec.conf /etc/ipsec.d/</pre>
    Verify any returned results for organizational approval.
