The IPsec BIG-IP appliance must use IKEv2 for IPsec VPN security associations.

To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.

Use of IKEv2 leverages denial of service (DoS) protections because of improved bandwidth management and leverages more secure encryption algorithms.

From the BIG-IP GUI: 1. Network. 2. IPsec. 3. IKE Peers. 4. Click on the name of the IKE peer. 5. Verify "Version 2" is selected for "Version".

If the BIG-IP appliance is not configured to use IKEv2 for IPsec VPN security associations, this is a finding.

From the BIG-IP GUI: 1. Network. 2. IPsec. 3. IKE Peers. 4. Click on the name of the IKE peer. 5. Select "Version 2" for "Version". 6. Click "Update".