acceptedInfrastructure Router - Juniper Security Technical Implementation GuideInfrastructure Router Security Technical Implementation Guide - JuniperDISASTIG.DOD.MILRelease: 24 Benchmark Date: 27 Oct 20178I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>Interface ACL deny statements are not logged.<GroupDescription></GroupDescription>NET1020The network device must log all access control lists (ACL) deny statements.<VulnDiscussion>Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECAT-1, ECAT-2, ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure interface ACLs to log all deny statements.Review the network device interface ACLs to verify all deny statements are logged.
Either the syslog or log action command will satisfy this requirement.
JUNOS Example:
[edit firewall]
family inet {
filter NIPRNet-ingress {
term first-accept {
from {
}
then accept;
}
term last-accept {
from {
destination-address {
131.77.5.32/32;
131.77.5.61/32;
}
protocol tcp;
destination-port http;
}
then accept;
}
term default-action {
then {
syslog;
discard;
}
}
}
}IPSec VPN is not configured as a tunnel type VPN.<GroupDescription></GroupDescription>NET1800The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.<VulnDiscussion>Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Establish the VPN as a tunneled VPN.
Terminate the tunneled VPN outside of the firewall.
Ensure all host-to-host VPN are established between trusted known hosts.
Have the SA display the configuration settings that enable this feature.
Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples:
In CISCO
Router(config)# crypto ipsec transform-set transform-set-name transform1
Router(cfg-crypto-tran)# mode tunnel
OR in Junos
edit security ipsec security-association sa-name] mode tunnelNetwork element is not password protected.<GroupDescription></GroupDescription>NET0230Network devices must be password protected.<VulnDiscussion>Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network devices so it will require a password to gain administrative access to the device.Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required.
If passwords aren't used to administrative access to the device, this is a finding.Login banner is non-existent or not DOD-approved.<GroupDescription></GroupDescription>NET0340Network devices must display the DoD-approved logon banner warning.<VulnDiscussion>All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.
DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:
Option A
You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
Option B
If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:
Option A
You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
Option B
If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."
If the device configuration does not have a logon banner as stated above, this is a finding.Management connection does not timeout.<GroupDescription></GroupDescription>NET1639The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.<VulnDiscussion>Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example:
[edit system login]
class superuser-local {
idle-timeout 10;
permissions all;
}
Note: There is no default idle-timeout; hence, without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class.
When ssh is enabled, all users can use it to access the router---including the root account. This presents two problems:
1) The root account now be accessed using in-band management
2) Since the root account does not belong to a login class, there is no way to set the idle timeout.
Access to the root account via ssh must be disabled via root-login deny command. Following is an example configuration:
[edit system]
services {
ssh {
root-login deny;
DNS servers must be defined for client resolver. <GroupDescription></GroupDescription>NET0820The network element must have DNS servers defined if it is configured as a client resolver.<VulnDiscussion>The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to include DNS servers or disable domain lookup.Review the active configuration to ensure that DNS servers have been defined similar to the following example:
[edit system]
name server {
192.168.1.253;
192.168.1.254;
}
Note: Since JUNOS will not send a DNS query to resolve names to IP addresses if a name server is not defined, this will never be a finding.
SNMP access is not restricted by IP address.<GroupDescription></GroupDescription>NET0890The network element must only allow write and poll SNMP access by authorized internal IP addresses.<VulnDiscussion>Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network devices to only allow SNMP access from only addresses belonging to the management network.Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example:
snmp {
interface ge-0/1/0.0;
community xxxxxxxxx {
authorization read-only;
clients {
default restrict;
7.7.7.5/32;
}
}
}
Note: if the clients statement is not present, then all clients are allowed.
Interior routing protocols are not authenticated.<GroupDescription></GroupDescription>NET0400The network element must authenticate all IGP peers.<VulnDiscussion>A rogue router could send a fictitious routing update to convince a site’s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure authentication for all IGP peers.Review the device configuration to determine if authentication is configured for all IGP peers.
If authentication is not configured for all IGP peers, this is a finding.OSPF Example
[edit protocols ospf]
area 0.0.0.0 {
authentication-type md5
interface ge-0/0/0.0 {
authentication-key xxx key-id xxxxxx;
}
}
Note: Authentication has to be enabled for each area. In OSPF, an interface belongs to only one area, which is defined by the interface statement under the area statement that it belongs to. The MD5 keyid and password is defined under each interface connected to an OSPF neighbor.
SNMP privileged and non-privileged access.<GroupDescription></GroupDescription>NET1675The network device must use different SNMP community names or groups for various levels of read and write access.<VulnDiscussion>Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access.
If unique community strings or accounts are not used for SNMP peers, this is a finding.Group accounts are defined.<GroupDescription></GroupDescription>NET0460Group accounts must not be configured for use on the network device.<VulnDiscussion>Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure individual user accounts for each authorized person then remove any group accounts.Review the network device configuration and validate there are no group accounts configured for access.
If a group account is configured on the device, this is a finding.Accounts assigned least privileges necessary to perform duties.<GroupDescription></GroupDescription>NET0465Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.<VulnDiscussion>By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties.
If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.
Below is an example configuration with three levels of authorization followed by account templates.
[edit system login]
class tier1 {
idle-timeout 15;
permissions [configure interface network routing snmp system trace view firewall ];
}
class tier2 {
idle-timeout 15;
permissions [admin clear configure interface network reset routing routing-control
snmp snmp-control system system-control trace trace-control view maintenance firewall
firewall-control secret rollback ];
}
class tier3 {
idle-timeout 15;
permissions all;
}
/* This is our local superuser account with a local password. */
user admin {
full-name Administrator;
uid 2000;
class tier3;
authentication {
encrypted-password xxxxxxx;
}
}
/* TACACS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
user tier3 {
uid 2003;
class tier3;
}
Using the example JUNOS configuration above and TACACS configuration below, when a user is using a template account, the CLI username is the login name; however, the privileges, file ownership, and effective user ID are inherited from the template account. The CLI username is sent to the authentication server with the correct password. The server returns the local username (i.e., “tier2”) to the JUNOS software as specified in the authentication server (local-user-name for TACACS+, Juniper-Local-User for RADIUS).
user = simon {
.
.
.
.
service = junos-exec {
local-user-name = tier2
allow-commands = "configure"
deny-commands = "shutdown"
}
}
'allow-commands' and 'deny-commands' override permissions of the class of the template that the local-user-name is associated with.
Unauthorized accounts are configured to access device.<GroupDescription></GroupDescription>NET0470Unauthorized accounts must not be configured for access to the network device.<VulnDiscussion>A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device.
If an unauthorized account is configured for access to the device, this is a finding.Passwords are viewable when displaying the config.<GroupDescription></GroupDescription>NET0600The network element must be configured to ensure passwords are not viewable when displaying configuration information. <VulnDiscussion>Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.Management connections must be secured by FIPS 140-2. <GroupDescription></GroupDescription>NET1638Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.<VulnDiscussion>Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols.
-SSHv2
-SCP
-HTTPS
-SSL
-TLS
JUNOS Example:
[edit system services]
ssh {
root-login (allow | deny | deny-password);
protocol-version [ v2 ];
macs [hmac-sha1 hmac-sha1-96];
ciphers [aes128-cbc aes192-cbc aes256-cbc];
}
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
…
[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port ssh;
}
then {
syslog;
accept;
}
}
…
term default-action {
then {
syslog;
discard;
}
}
}
}
If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.Management connections must be logged.<GroupDescription></GroupDescription>NET1640The network element must log all attempts to establish a management connection for administrative access.<VulnDiscussion>Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to log all access attempts to the device to establish a management connection for administrative access.Review the router configurations and verify that all ssh connection attempts are logged. The configuration should look similar to the following:
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port [ssh];
}
then {
syslog;
accept;
}
}
term default-action {
then {
syslog;
discard;
}
}
}
}
The finger service is not disabled.<GroupDescription></GroupDescription>NET0730The network element must have the Finger service disabled.<VulnDiscussion>The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to disable the Finger service.Under the edit system services hierarchy, enter a show command to verify that the finger command is not present. IP Source Routing is not disabled on all routers.<GroupDescription></GroupDescription>NET0770The router must have IP source routing disabled.<VulnDiscussion>Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the router to disable IP source routing.Under the edit chassis hierarchy, enter a show command to verify that the no-source-route command is present.HTTP server is not disabled <GroupDescription></GroupDescription>NET0740The network element must have HTTP service for administrative access disabled.<VulnDiscussion>The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to disable using HTTP (port 80) for administrative access.Under the edit system services hierarchy enter a show command to verify the web-management http command is not present (the web-management https command may be enabled for administrative access). If you are reviewing an entire configuration, verify the web-management http command is not present as shown in the example below:
system {
services {
web-management {
http {
interface ge-0/0/0.0;
}
}
}
}
If the HTTP server is enabled, this is a finding.Devices exist with standard default passwords.<GroupDescription></GroupDescription>NET0240Network devices must not have any default manufacturer passwords.<VulnDiscussion>Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Remove any vendor default passwords from the network devices configuration.Review the network devices configuration to determine if the vendor default password is active.
If any vendor default passwords are used on the device, this is a finding.Operating system is not at a current release level.<GroupDescription></GroupDescription>NET0700The network element must be running a current and supported operating system with all IAVMs addressed.<VulnDiscussion>Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Update operating system to a supported version that addresses all related IAVMs.In operational mode, have the router administrator execute the show version brief command to verify the installed JUNOS version. This command will show the base OS as well as the kernel, packet forwarding engine, routing, and crypto. Validate that all software components are at the required level.
J, M and T series should be 10.0 or later.
E series should be 10.2 or later
Verify that all IAVMs have been addressed.
Management connections must require passwords.<GroupDescription></GroupDescription>NET1636The network device must require authentication prior to establishing a management connection for administrative access.<VulnDiscussion>Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure authentication for all management connections.Review the network device configuration to verify all management connections for administrative access require authentication.
With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. Following is an example:
[edit system]
authentication-order [ radius password ];
radius-server {
192.168.6.5 {
secret "xxxxxxx";
}
}
login {
/* login classes */
class tier1 {
idle-timeout 10;
permissions all;
}
class tier2 {
idle-timeout 10;
permissions [ configure interface network routing snmp system trace view firewall ];
}
/* local emgergency account */
user admin {
full-name Administrator;
uid 2000;
class tier1;
authentication {
encrypted-password "xxxx"; # SECRET-DATA
}
}
/* RADIUS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
}
Note: When SSH is enabled, all users can use this service to access the router---including the root account. Access to the root account via SSH must be disabled via root-login deny command. Following is an example configuration:
[edit system]
services {
ssh {
root-login deny;
An insecure version of SNMP is being used.<GroupDescription></GroupDescription>NET1660The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.<VulnDiscussion>SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.
Downgrades:
If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.
If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.
If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.
If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.Using default SNMP community names.<GroupDescription></GroupDescription>NET1665The network device must not use the default or well-known SNMP community strings public and private.<VulnDiscussion>Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure unique SNMP community strings replacing the default community strings.Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used.
If default or well-known community strings are used for SNMP, this is a finding.More than one local account is defined.<GroupDescription></GroupDescription>NET0440In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.<VulnDiscussion>Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency.
Example:
[edit system]
class tier3 {
idle-timeout 15;
permissions all;
}
user admin {
full-name Administrator;
uid 2000;
class tier3;
authentication {
encrypted-password xxxxxxxxxxx;
}
}
Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe.
If an authentication server is used and more than one local account exists, this is a finding.The console port does not timeout after 10 minutes.<GroupDescription></GroupDescription>NET1624The network element must time out access to the console port after 10 minutes or less of inactivity.<VulnDiscussion>Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the timeout for idle console connection to 10 minutes or less.With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example:
[edit system login]
class superuser-local {
idle-timeout 10;
permissions all;
}
Notes:
1. There is no default idle-timeout. Without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class.
2. Since the root account does not belong to a class and you can access root via console, disable the ability to login using the root account by making the console insecure as follows:
[edit system]
console {
insecure;
}
Network element must only allow SNMP read access.<GroupDescription></GroupDescription>NET0894The network device must only allow SNMP read-only access.<VulnDiscussion>Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.
If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding.
The SNMP V1 configuration should look similar to the following:
snmp {
interface ge-0/1/0.0;
community xxxxxxxxx {
authorization read-only;
clients {
default restrict;
7.7.7.5/30;
}
}
SNMPv3 access sets the SNMP access levels by context, group, and user. The context-name statement determines what management information is accessible by an SNMP entity. An SNMP entity can have access to many access contexts and therefore requires a name to identify each context. You must also associate a context with a specific access group and configure read and write views associated with each group. Specify the group-name variable to identify a collection of SNMP users that share the same access policy, in which object identifiers (OIDs) are read-accessible or write-accessible. Each group is the collection of users associated with the security model. You can only specify the model usm.
The example below as a “router context” which is accessed by two groups: NOC and engineers. NOC is only allowed read access while engineers have read and write access. John and Sue are users that belong to the engineers group and have authentication configured.
snmp {
view all {
oid .1.3.6.1 include;
}
engine-id {
local "isp-routers-0001";
}
access {
user john {
authentication-type md5;
authentication-password "john-auth-password";
privacy-type des;
privacy-password "john-privacy-password";
}
user sue {
authentication-type md5;
authentication-password "sue-auth-password";
privacy-type des;
privacy-password "sue-privacy-password";
}
user hpov {
authentication-type md5;
authentication-password "hpov-auth-password";
privacy-type des;
privacy-password "hpov-privacy-password";
}
group engineers {
model usm;
user [john sue];
}
group noc {
model usm;
user hpov;
}
context router {
description “a router context”;
group noc {
model usm;
security-level privacy;
read-view all;
}
group engineers {
model usm;
security-level privacy;
read-view all;
write-view all;
}
}
}Authentication required for console access.<GroupDescription></GroupDescription>NET1623The network device must require authentication for console access.<VulnDiscussion>Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>IAIA-1, IAIA-2</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure authentication for console access on the network device.Review the network device's configuration and verify authentication is required for console access.
With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class as shown in the following example:
[edit system]
authentication-order [ radius password ];
radius-server {
192.168.6.5 {
secret "xxxxxxx";
}
}
login {
/* login classes */
class tier1 {
idle-timeout 10;
permissions all;
}
class tier2 {
idle-timeout 10;
permissions [ configure interface network routing snmp system trace view firewall ];
}
/* local emgergency account */
user admin {
full-name Administrator;
uid 2000;
class tier1;
authentication {
encrypted-password "xxxx"; # SECRET-DATA
}
}
/* RADIUS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
}
Note: Since the root account does not belong to a class and you can access root via console, disable the ability to login at the console using the root account by making the console insecure as follows:
[edit system]
console {
insecure;
}
Password required on the JUNOS diagnostic port.<GroupDescription></GroupDescription>NET0580The router administrator will ensure a password is required to gain access to the router's diagnostics port.<VulnDiscussion>If unauthorized users gain access to the routers diagnostic port, it is possible to disrupt service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510The router administrator will ensure that a password is required to access the routers diagnostic port.IOS Procedure: N/A A Cisco router does not have a diagnostics port.
JUNOS Procedure: Review the router configuration to ensure a password is required when gaining access to the diagnostics port similar to the following:
[edit system]
diag-port-authentication {
encrypted-password "xxxxxxxxxxxxx"; # SECRET-DATA
}The network element must log all messages except debugging.<GroupDescription></GroupDescription>NET1021The network element must log all messages except debugging and send all log data to a syslog server.<VulnDiscussion>Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to log all messages except debugging and send all log data to a syslog server.Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example:
[edit system syslog]
syslog {
host 192.168.1.22 {
any info;
facility-override local7;
}
}
The table below lists the severity levels and message types for all log data.
Severity
Level Message Type
0 Emergencies
1 Alerts
2 Critical
3 Errors
4 Warning
5 Notifications
6 Informational
7 Debugging
Management connections are not restricted.<GroupDescription></GroupDescription>NET1637The network element must only allow management connections for administrative access from hosts residing in to the management network.<VulnDiscussion>Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure an ACL or filter to restrict management access to the device from only the management network.Review the router configuration and verify that only authorized internal connections are allowed access to the routing engine via ssh. Access to the Juniper routing engine is via loopback interface. The configuration should look similar to the following:
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port ssh;
}
then {
syslog;
accept;
}
}
term default-action {
then {
log;
discard;
}
}
}
}
SSH session timeout is not 60 seconds or less.<GroupDescription></GroupDescription>NET1645The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.<VulnDiscussion>An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network devices so it will require a secure shell timeout of 60 seconds or less.Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.
system {
login {
retry-options {
tries-before-disconnect 3;
maximum-time 60;
}SSH login attempts value is greater than 3.<GroupDescription></GroupDescription>NET1646The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.<VulnDiscussion>An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.
system {
login {
retry-options {
tries-before-disconnect 3;
maximum-time 60;
}Devices not configured to filter and drop half-open connections.<GroupDescription></GroupDescription>NET0965The network device must drop half-open TCP connections through filtering thresholds or timeout periods.<VulnDiscussion>A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator.
An attacker’s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections.
For timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering.
JUNOS Configuration Example:
firewall {
policer TCP-SYN-Policer {
if-exceeding {
bandwidth-limit 500k;
burst-size-limit 15k;
}
then discard;
}
family inet {
filter DOS-Protect {
.
.
.
/* Term tcp-syn-fin-limit: Rate limit TCP packets with SYN/FIN/RST flags. */
term tcp-syn-fin-limit {
from {
protocol tcp;
port [bgp ldp snmp snmptrap telnet ftp ftp-data ssh];
tcp-flags “syn | fin | rst”;
}
then policer TCP-SYN-Policer;
}
.
.
}The auxiliary port is not disabled.<GroupDescription></GroupDescription>NET1629The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.<VulnDiscussion>The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.
Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.If the following configuration statements are found than a secure modem should be in place.
[edit system]
ports {
auxiliary {
type vt100;
}
}
Key expiration exceeds 180 days.<GroupDescription></GroupDescription>NET0422Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.<VulnDiscussion>If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device so rotating keys expire at 180 days or less.Review device configuration for key expirations of 180 days or less.
If rotating keys are not configured to expire at 180 days or less, this is a finding.FTP server is not disabled <GroupDescription></GroupDescription>NET0742The router administrator will ensure FTP server is disabled. <VulnDiscussion>The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Disable FTP server services on the device.Review the device configuration to determine if the device has been setup to be an FTP server.
If the device has been configured to be an FTP server, this is a finding.Junos Procedure: Under the edit system services hierarchy, enter a show command to verify that the ftp command is not present.BSDr commands are not disabled.<GroupDescription></GroupDescription>NET0744The network element must have all BSDr commands disabled.<VulnDiscussion>Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a "trusted" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to disable BSDr command services.Under the edit system services hierarchy, enter a show command to verify that the rlogin command is not present.Disable vulnerable ICMP messages on external int.<GroupDescription></GroupDescription>NET0802The router administrator will ensure ICMPv6 unreachable notifications, and redirects are disabled on all external interfaces of the premise router.<VulnDiscussion>The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces.ICMP Unreachable
1. Protocol Unreachable
The filter used for the routing engine must be configured to silently discard any packets it does not recognize or want. Following would be an example:
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
[edit firewall]
family inet {
filter protect-routing-engine {
term 1 {
.
.
.
term default-action {
then {
syslog;
discard;
}
}
}
}
2. Host Unreachable
The only method to prevent a Juniper router from sending a Host Unreachable message back to the originator when it receives a packet with a destination address that is not found in its forwarding table, is t define a default route to the discard interface. The filter applied to this interface would then silently discard the packets.
[edit interfaces]
dsc {
unit 0 {
family inet {
filter {
input log-discard;
}
address 10.1.1.1/32 {
destination 10.1.1.2;
}
}
}
}
[edit firewall]
family inet {
filter log-discard {
term one {
then {
syslog;
discard;
}
}
}
}
[edit routing-options]
static {
route 0.0.0.0/0 next-hop 10.1.1.2 ;
}
3. Aggregate and black hole routes
A Juniper router will also send ICMP unreachable messages for packets that have a destination address of an aggregate route as well as a black hole route.
a. Checking aggregate routes
By default, when aggregate routes are installed in a Juniper routing table, the next hop is configured as a reject route. Hence the packet is dropped and an ICMP unreachable message is sent to the packet’s originator if the aggregate route itself is the result of a routing table longest-match lookup or a packet with a more specific destination under the advertised summary route does not match a more specific route (contributing route). These packets can be quietly dropped by specifying discard for an individual route in the route part of the aggregate statement, or specifying reject when you configure the defaults for aggregate routes.
[edit routing-options]
aggregate {
route 192.168.0.0/17 discard ;
or
[edit routing-options]
aggregate {
defaults {
active;
discard;
community 2:333;
}
}
Note: You can also issue the operational command show route protocol aggregate to determine if discard or reject option is used.
b. Checking black hole routes
[edit routing-options]
static {
route 0.0.0.0/8 discard;
route 1.0.0.0/8 discard;
route 5.0.0.0/8 discard;
.
ICMP Redirects
Under the edit system hierarchy enter a show command to verify that the no-redirects command is present on all Juniper routers. This restriction can also be enforced by including the no-redirects statement under each active interface.
[edit system]
no-redirects;
or
[edit interfaces]
fe-2/0/1 {
description "NIPRNet link";
unit 0 {
family inet {
no-redirects;
filter {
input ingress-filter;
}
address 121.70.11.68/29;
}
}
}
}
ICMP Mask Reply
JUNOS has no option to not reply to an ICMP Mask Request message. Consequently, to ensure that the router does not send any ICMP Mask Reply messages in response to a mask request, include a term statement in the routing engine firewall to drop any masks requests sent to it.
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
[edit firewall]
family inet {
filter protect-routing-engine {
term icmp-mask-request {
from {
protocol icmp;
icmp-type mask-request;
}
then {
log;
discard;
}
}
}
}
NTP messages are not authenticated.<GroupDescription></GroupDescription>NET0813The network element must authenticate all NTP messages received from NTP servers and peers.<VulnDiscussion>Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source.
Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.
A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers.
The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or a FIPS-approved message authentication code algorithm.Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using either PKI or a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.
If the network element is not configured to authenticate received NTP messages using PKI or a FIPS-approved message authentication code algorithm, this is a finding.Authentication traffic does not use loopback address or OOB Management interface.<GroupDescription></GroupDescription>NET0897The router must use its loopback or OOB management interface address as the source address when originating TACACS+ or RADIUS traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead.
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on JUNOS routers; however, multiple addresses can be defined.
Step 2: Verify that TACACS+ and RADIUS are configured to use the loopback address by comparing the source address defined for tacplus-server and radius-server with the address configured for the loopback interface. You should find a configuration similar to the examples below:
TACACS+
system {
tacplus-server {
10.10.2.11;
source-address 10.10.2.1;
}
}
RADIUS
system {
radius-server {
10.10.2.21;
source-address 10.10.2.1;
}
}
Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:
system {
default-address-selection;
…
}
}
Syslog traffic is not using loopback address or OOB management interface.<GroupDescription></GroupDescription>NET0898The router must use its loopback or OOB management interface address as the source address when originating syslog traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.
Step 2: Verify that syslog is configured to use the loopback address by comparing the source address defined for syslog with the address configured for the loopback interface. You should find a configuration similar to the examples below:
system {
syslog {
host 192.168.1.100 {
any info;
}
source-address 192.168.1.1;
}
}
Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:
system {
default-address-selection;
…
}
}
NTP traffic is not using loopback address or OOB Management interface.<GroupDescription></GroupDescription>NET0899The router must use its loopback or OOB management interface address as the source address when originating NTP traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.
Step 2: Verify that NTP is configured to use the loopback address by comparing the source address defined for NTP with the address configured for the loopback interface. You should find a configuration similar to the examples below:
system {
ntp {
server 10.10.2.21;
source-address 10.10.2.1;
}
}
Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:
system {
default-address-selection;
…
}
}
SNMP traffic does not use loopback address or OOB Management interface.<GroupDescription></GroupDescription>NET0900The router must use its loopback or OOB management interface address as the source address when originating SNMP traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.
Step 2: Verify that SNMP is configured to use the loopback address by comparing the source address defined for SNMP with the address configured for the loopback interface. You should find a configuration similar to the examples below:
snmp {
clients {
default restrict;
10.10.2.111/32;
}
trap-options {
source-address 10.10.2.1;
}
}
Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:
system {
default-address-selection;
…
}
}
Netflow traffic is not using loopback address.<GroupDescription></GroupDescription>NET0901The router must use its loopback or OOB management interface address as the source address when originating NetFlow traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Netflow messages sent to management servers should use the loopback address as the source address. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.Review the configuration and verify the loopback interface address is used as the source address when originating Netflow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.
Step 2: Juniper has adopted the Cisco PDU format for flow export; However, Juniper does not call it NetFlow but "cflowd" and uses the flow export concept as a means to export packet-sampling data. Juniper has a filtering mechanism which allows you to sample packets and log them to the local file system or they can be exported using the "cflowd" forwarding options.
You should find a configuration similar to the example below depicting the source address for cflowd:
forwarding-options {
sampling {
input {
family inet {
rate 100;
run-length 4;
max-packets-per-second 5000;
}
}
output {
cflowd 10.10.2.22 {
port 9991;
source-address 10.10.2.1;
}
}
}
Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:
system {
default-address-selection;
…
}
}
FTP/TFTP traffic does not use loopback address or OOB Management interface.<GroupDescription></GroupDescription>NET0902The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to use a loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic.
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
address x.x.x.x/32;
}
}
}
Step 2: There is no method to override the source address default for TFTP and FTP. Hence, the router must be configured to use the loopback as the default source address for all locally generated traffic. This is accomplished by configuring the default-address-selection statement as shown in the following example:
system {
default-address-selection;
…
}
}
If the device is managed from an OOB management network, the OOB interface must be used instead.
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.Loopback address is not used as the iBGP source IP.<GroupDescription></GroupDescription>NET0903The router must use its loopback interface address as the source address for all iBGP peering sessions.<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device's loopback address as the source address for iBGP peering.Review the configuration and verify the loopback interface address is used as the source address for all iBGP peering.
Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}
Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.
Step 2: The vulnerability does not require eBGP peering to use the loopback address. Hence, the BGP router only requires that the loopback address is used to peer with its iBGP neighbors. You should find a configuration similar to the example below:
protocols {
bgp {
group iBGP_111 {
type internal;
local-address 10.10.2.1;
export next-hop-self;
peer-as 111;
neighbor 10.10.2.2;
}
}
}
IPv6 Site Local Unicast ADDR must not be defined<GroupDescription></GroupDescription>NET-IPV6-025The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.<VulnDiscussion>As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device using authorized IP addresses.Review the device configuration to ensure FEC0::/10 IP addresses are not defined.
If FEC0::/10 IP addresses are defined, this is a finding.IPv6 Egress Outbound Spoofing Filter <GroupDescription></GroupDescription>NET-IPV6-034The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.<VulnDiscussion>Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped.
If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address).
To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field. Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.Step 1: Verify that uRPF check is enabled. The unicast-reverse-path statement must be included in the
routing-options forwarding-table hierarchy level. The configuration should look similar to the following:
routing-options {
forwarding-table {
unicast-reverse-path active-paths;
}
}
Note: To consider all feasible paths during the uRPF check, include the feasible-paths option. Feasible is a
superset of active path. For example, if you have BGP session where you receive a route advertisement
and you accept it (but it is not active, because there's some other route with better preference), that's
considered a feasible path.
Step 2: Verify that uRPF strict mode is enabled on all customer-facing interfaces. The absence of the mode
loose statement defaults to strict mode. The configuration should look similar to the following:
interfaces {
so-0/0/0 {
unit 0 {
family inet6 {
rpf-check;
}
}
}
}
Step 3: If the incoming packet fails the unicast RPF check, the packet is not accepted on the interface.
However, when a packet is not accepted on an interface, unicast RPF counts the packet and may send it to
an optional fail-filter. You can define the fail-filter to perform any operation, including accepting,
rejecting, logging, sampling, or policing. Hence, if a fail-filter was defined as shown in the below, verify
that it does not accept the packet. The configuration should look similar to the following:
interfaces {
so-0/0/0 {
unit 0 {
family inet6 {
rpf-check fail-filter rpf-fail;
}
}
}
}
firewall {
filter rpf-fail {
term 1 {
then {
log;
reject;
}
}
}
}
The network element must not allow SSH Version 1.<GroupDescription></GroupDescription>NET1647The network element must not use SSH Version 1 for administrative access.<VulnDiscussion>SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to use SSH version 2.If SSH is used for administrative access, then Version 2 must be configured as shown in the following example:
system {
services {
ssh {
protocol-version v2;
}
}
}
ISATAP tunnels must terminate at interior router.<GroupDescription></GroupDescription>NET-TUNL-017ISATAP tunnels must terminate at an interior router.<VulnDiscussion>ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.The device is not authenticated using a AAA server.<GroupDescription></GroupDescription>NET0433Network devices must use two or more authentication servers for the purpose of granting administrative access.<VulnDiscussion>The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity.
The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use two separate authentication servers.Verify an authentication server is required to access the device and that there are two or more authentication servers defined.
If the device is not configured for two separate authentication servers, this is a finding.Emergency administration account privilege level is not set.<GroupDescription></GroupDescription>NET0441The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.<VulnDiscussion>The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online.
If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.Management traffic is not restricted<GroupDescription></GroupDescription>NET1807IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.<VulnDiscussion>The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network.
If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.Remote VPN end-point not a mirror of local gateway<GroupDescription></GroupDescription>NET1808Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway <VulnDiscussion>The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.IGP instances do not peer with appropriate domain<GroupDescription></GroupDescription>NET0985IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain<VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where RIP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements.
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “Enclave Management LAN”
unit 0 {
family inet {
address 10.1.1.1/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
address 10.1.20.3/24;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
interface lo0.0;
}
}
rip {
group rip-neighbor {
neighbor t3-3/0/3.0;
export rip-advertisements;
}
}
}
policy-options {
policy-statement rip-advertisements {
from protocol rip;
then accept;
}
}
policy-statement direct-management-LAN {
from {
protocol direct;
interface [ lo0.0 t3-3/0/3.0 fe-0/0/2 ];
}
then accept;
}
}
Note: When you enable RIP, the default JUNOS behavior is to accept all learned RIP routes but export no routes to RIP neighbors. To have RIP send routing information to its neighbors, you need to configure a routing policy that has RIP export routes to its neighbors. In the example above, the OOBM gateway router will only have a RIP neighbor adjacency with its upstream OOB backbone router. However, it will advertise to the RIP domain the local management address prefix and the loopback address which also belongs to the management network.
Routes from the two IGP domains are redistributed <GroupDescription></GroupDescription>NET0986The routes from the two IGP domains are redistributed to each other.<VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts> </PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.
There is no equivalent redistribute command in JUNOS. All redistribution of routes between protocols is done through the creation of a routing policy through the use of import and export statements. Verify that there are no export and policy-statement commands configured that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following example illustrates how RIP routes would be redistributing into OSPF.
policy-options {
policy-statement rip-to-ospf {
from protocol rip;
then accept;
}
}
}
protocols {
ospf {
export rip-to-ospf;
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
}
}
As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well.
If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone.
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
address 10.1.20.3/24;
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
interface lo0.0;
}
}
routing-options {
static {
route 10.1.1.0/24 {
next-hop 10.1.20.4;
}
}
}
Managed network has access to OOBM gateway router<GroupDescription></GroupDescription>NET0987Traffic from the managed network is able to access the OOBM gateway router<VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway rouiter.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic.
Step 1: Verify that an inbound filter has been applied to loopback interface. This filter is used to restrict all traffic to the router engine. The interface configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
no-redirects;
filter {
input router-protect-filter;
}
address 10.1.3.41/32;
}
}
}
}
Note: the address block used for loopback addresses should be independent of the address space used for the management backbone, the NOC, or the local management subnet. Loopback address should be configured with /32 prefixes to enable proper route advertisements and optimum path reachability for both control plane and management plane traffic within the global management network.
Step 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC.
Step 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The filter configuration should look similar to the following:
firewall {
filter router-protect-filter {
term ospf-neighbors {
from {
source-address {
10.2.2.0/24;
}
protocol ospf;
}
then {
syslog;
accept;
}
}
term ssh-access {
from {
source-address {
10.2.2.0/24;
}
protocol tcp;
destination-port ssh;
}
then {
syslog;
accept;
}
}
term snmp-access {
from {
source-address {
10.2.2.24/32;
10.2.2.25/32;
}
protocol udp;
destination-port snmp;
}
then {
syslog;
accept;
}
}
term tacacs-access {
from {
source-address {
10.2.2.30/32;
}
protocol tcp;
port tacacs-ds;
}
then {
syslog;
accept;
}
}
term ftp-access {
from {
source-address {
10.2.2.77/32;
}
protocol tcp;
port [ftp ftp-data];
}
then {
syslog;
accept;
}
}
term allow-ICMP {
from {
source-address {
10.2.2.0/24;
}
protocol icmp;
}
then accept;
}
term default-action {
then {
syslog;
discard;
}
}
}
}
Traffic from the managed network will leak <GroupDescription></GroupDescription>NET0988Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.<VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
filter {
output OOBM-egress-filter;
}
address 10.1.20.3/24;
}
}
}
}
firewall {
filter OOBM-egress-filter {
term allow-mgmt {
from {
source-address {
10.1.1.0/24;
}
destination-address {
10.2.2.0/24;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}
Management traffic leaks into the managed network<GroupDescription></GroupDescription>NET0989Management network traffic is leaking into the managed network.<VulnDiscussion>If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network’s production address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
address 10.1.1.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.20.3/24;
}
}
}
firewall {
filter OOBM-ingress-filter {
term allow-mgmt {
from {
source-address {
10.2.2.0/24;
}
destination-address {
10.1.1.0/24;
}
}
then {
accept;
}
}
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}
The OOBM interface not configured correctly.<GroupDescription></GroupDescription>NET0991The network element’s OOBM interface must be configured with an OOBM network address.<VulnDiscussion>The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24.
interfaces {
fxp0 {
description “link to OOBM access switch”
unit 0 {
family inet {
address 10.1.1.22/24;
}
}
}
The management interface does not have an ACL.<GroupDescription></GroupDescription>NET0992The management interface is not configured with both an ingress and egress ACL. <VulnDiscussion>The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.
An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.Step 1: Verify that the managed interface has an inbound and outbound filter configured as shown in the following example:
interfaces {
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.1.22/24;
}
}
}
Step 2: Verify that the ingress filter blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24.
firewall {
filter OOBM-ingress-filter {
term allow-mgmt {
from {
source-address {
10.2.2.0/24;
}
destination-address {
10.1.1.22/32;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}
Step 3: Verify that the egress filter blocks any traffic exiting the management interface that was not originated by the managed elements . Verify that the destination address is the NOC address space.
firewall {
filter OOBM-egress-filter {
term allow-mgmt {
from {
source-address {
10.1.1.22/32;
}
destination-address {
10.2.2.0/24;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}
The management interface is not IGP passive.<GroupDescription></GroupDescription>NET0993The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network.<VulnDiscussion>The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.
An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. With JUNOS, routing protocols are enabled on the interfaces by specifying the interface under the routing protocol hierarchy. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface:
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.1.22/24;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
}
}
}
No inbound ACL for mgmt network sub-interface<GroupDescription></GroupDescription>NET1005An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.
<VulnDiscussion>If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510 If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.
Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration:
interfaces fe-1/1/1 {
vlan-tagging;
unit 10 {
family inet {
filter {
input ingress-mgmt-vlan-filter;
}
address 10.1.1.1/24;
}
}
}
firewall {
filter ingress-mgmt-vlan-filter {
term …
IPSec traffic is not restricted<GroupDescription></GroupDescription>NET1006Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address. <VulnDiscussion>Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address. Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). Example from a show services command with Juniper M or T series router with Adaptive Services PIC using next-hop style is as follows:
service-set vpn-to-NOC {
next-hop-service {
inside-service-interface sp-0/0/0.1;
outside-service-interface sp-0/0/0.2;
}
ipsec-vpn-options {
local-gateway 19.16.1.1;
}
ipsec-vpn-rules site-to-NOC;
}
ipsec-vpn {
rule site-to-NOC {
term mgmt-traffic {
}
destination-address {
10.2.2.0/24;
}
}
then
remote-gateway 19.16.2.1;
dynamic {
ike-policy main_mode_ike_policy;
ipsec-policy dynamic_ipsec_policy;
}
}
}
match-direction input;
}
ipsec {
proposal esp_sha1_ipsec_prop {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
}
policy dynamic_ipsec_policy {
perfect-forward-secrecy {
keys group2;
}
proposals esp_sha1_ipsec_prop;
}
}
ike {
proposal psk_sha1_3des_ike_prop {
authentication-method pre-shared-keys;
authentication-algorithm sha1;
encryption-algorithm 3des-cbc;
}
policy main_mode_ike_policy {
mode main;
proposals psk_sha1_3des_ike_prop;
pre-shared-key ascii-text “$7#$AAtBRmNOjH”; ##SECRET-DATA
}
}
}
Note: Juniper recommends implementing all Layer 3 services with the next-hop-style service set as opposed to the interface-style. When you configure next-hop-style service sets, you associate them with specific inside and outside logical interfaces. These logical interfaces are units you configure on an AS PIC’s sp- interface as illustrated below:
interfaces {
sp-0/0/0 {
unit 0 {
family inet;
}
unit 1 {
description "IPSec Tunnel Inside Service Interface";
family inet;
service-domain inside;
}
unit 2 {
description "IPSec Tunnel Outside Service Interface";
family inet;
service-domain outside;
}
}
…
…
}
The router must be configured to match the traffic that is to be secured in the outbound direction. For next-hop service sets, this is the input direction as configured via match-direction input command as shown above under the services ipsec-vpn hierarchy. You configure the router to route traffic to the inside or outside interface as shown in the following example:
routing-options {
static {
route 10.2.2.0/24 next-hop sp-0/0/0.1;
}
}
Management traffic is not classified and marked<GroupDescription></GroupDescription>NET1007Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.<VulnDiscussion>When network congestion occurs, all traffic has an equal chance of being dropped.
Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed.
When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.Review the configuration of the MLS or router to determine if the management traffic is classified and marked to a favorable PHB at the distribution layer. According to the DISN approved QoS classifications, control plane and management plane traffic should use DSCP 48 (Network-Control PHB). In the example configurations below, an infrastructure router within the managed network’s distribution layer will classify and mark at ingress all traffic destined to management network with DSCP 48.
firewall {
family inet {
filter set-FC-to-network-control {
term match-management-network-prefix {
from {
destination-address {
10.10.10.0/24;
}
}
then {
forwarding-class network-control;
accept;
}
}
term accept-all {
then accept;
}
}
}
}
interfaces {
fe-0/0/2 {
description “link to LAN1”
unit 0 {
family inet {
filter {
input set-FC-to-network-control;
}
address 192.168.1.1/24;
}
}
}
fe-0/0/2 {
description “link to LAN2”
unit 0 {
family inet {
filter {
input set-FC-to-network-control;
}
address 192.168.2.1/24;
}
}
}
ge-0/0/1 {
description “link to core”
unit 0 {
family inet {
address 192.168.2.1/24;
}
}
}
}
By default, rewrite rules are not applied to interfaces. Without rewriting the DSCP value in the packet, the packet will be transmitted with the original value prior to classifying by the local router. To apply a rewrite rule, you can either use the default rules or design new rules. In either case, you must apply the rules to the outgoing interface under the class-of-service hierarchy as shown in the following configuration:
class-of-service {
interfaces {
ge-0/0/1 {
unit 0 {
rewrite-rules {
dscp default;
}
}
}
}
}
Management traffic doesn't get preferred treatment<GroupDescription></GroupDescription>NET1008The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.<VulnDiscussion>When network congestion occurs, all traffic has an equal chance of being dropped.
Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed.
When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network.
Step 1: Verify that all internal or core router interfaces are bound to a DSCP classifier and that both CE-facing and core-facing interfaces have a forwarding-class policy defined (i.e. scheduler-map) as shown in the configuration below:
class-of-service {
interfaces {
fe-* {
scheduler-map MAP-FC-Policy;
unit 0 {
classifiers {
dscp access-classifier;
}
rewrite-rules {
dscp basic-rewrite-rules;
}
}
}
ge-* {
scheduler-map MAP-FC-Policy;
unit 0 {
classifiers {
dscp core-classifier;
}
}
}
}
}
Step 2: Verify that the classifier places traffic in the appropriate forwarding class according to the approved DSCPs as shown in the example below:
class-of-service {
classifiers {
dscp access-classifier {
forwarding-class best-effort {
loss-priority high code-points 000000;
}
forwarding-class data-AF13-AF23 {
loss-priority high code-points 001110;
loss-priority low code-points 010110;
}
forwarding-class video-AF33-AF43 {
loss-priority high code-points 011110;
loss-priority low code-points 100110;
}
forwarding-class voice-EF {
loss-priority low code-points 101110;
}
forwarding-class network-control {
loss-priority low code-points 110000;
}
}
}
}
Step 3: Verify that the forwarding classes are associated with the correct queues and polices (i.e., schedulers) as shown in the example below:
class-of-service {
forwarding-classes {
queue 0 best-effort;
queue 1 data-AF13-AF23;
queue 2 video-AF33-AF43;
queue 3 voice-EF;
queue 4 network-control;
}
scheduler-maps {
MAP-FC-Policy {
forwarding-class best-effort scheduler Q0-best-effort;
forwarding-class data-AF13-AF23 scheduler Q1-data;
forwarding-class video-AF33-AF43 scheduler Q2-video;
forwarding-class voice-EF scheduler Q3-voice;
forwarding-class network-control scheduler Q4-network-control;
}
schedulers {
Q0-best-effort {
transmit-rate percent 20;
buffer-size percent 20;
drop-profile-map loss-priority low protocol any drop-profile be-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile be-high-drop-profile;
priority low;
}
Q1-data {
transmit-rate percent 35;
buffer-size percent 30;
drop-profile-map loss-priority low protocol any drop-profile data-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile data-high-drop-profile;
priority low;
}
Q2-video {
transmit-rate percent 40;
buffer-size percent 35;
drop-profile-map loss-priority low protocol any drop-profile video-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile video-high-drop-profile;
priority low;
}
Q3-voice {
buffer-size percent 10;
priority strict-high;
}
Q4-network-control {
transmit-rate percent 5;
buffer-size percent 5;
priority high;
}
}
drop-profiles {
video -high-drop-profile {
fill-level 30 drop-probability 30;
fill-level 50 drop-probability 50;
fill-level 70 drop-probability 60;
fill-level 90 drop-probability 100;
}
video -low-drop-profile {
fill-level 40 drop-probability 30;
fill-level 60 drop-probability 50;
fill-level 80 drop-probability 60;
fill-level 100 drop-probability 100;
}
data-high-drop-profile {
fill-level 25 drop-probability 30;
fill-level 45 drop-probability 50;
fill-level 65 drop-probability 60;
fill-level 85 drop-probability 100;
}
data-low-drop-profile {
fill-level 30 drop-probability 30;
fill-level 50 drop-probability 50;
fill-level 70 drop-probability 60;
fill-level 90 drop-probability 100;
}
be-high-drop-profile {
fill-level 20 drop-probability 30;
fill-level 40 drop-probability 50;
fill-level 60 drop-probability 60;
fill-level 80 drop-probability 100;
}
be-low-drop-profile {
fill-level 25 drop-probability 30;
fill-level 45 drop-probability 50;
fill-level 65 drop-probability 60;
fill-level 85 drop-probability 100;
}
}
}
Note: Scheduling policy maps configure the forwarding classes that represent packet queues for the physical interfaces that they are bound to. On M-series and T-series platforms, you can configure one queue per interface to have strict-high priority, which works the same as high priority, but provides unlimited transmission bandwidth. Hence, there is no need to define a transmit-rate for a strict-high priority queue. As long as the queue with strict-high priority has traffic to send, it receives precedence over all other queues, except queues with high priority. Queues with strict-high and high priority take turns transmitting packets until the strict-high queue is empty, the high priority queues are empty, or the high priority queues run out of bandwidth credit. Only then can lower priority queues send traffic.
If only 4 queues are supported by the interface, map two classes into one queue as shown in the following example:
class-of-service {
restricted-queues {
forwarding-class best-effort queue 0;
forwarding-class data-AF13-AF23 queue 0;
forwarding-class video-AF33-AF4 queue 1;
forwarding-class voice-EF 2;
forwarding-class network-control queue 3;
}
}
ACLs must restrict access to server VLANs.<GroupDescription></GroupDescription>NET-SRVFRM-003Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.<VulnDiscussion>Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.Review the device configuration to validate an ACL with a deny-by-default security posture has been implemented on the server VLAN interface.NET-TUNL-012<GroupDescription></GroupDescription>NET-TUNL-012Default routes must not be directed to the tunnel entry point.<VulnDiscussion>Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface.
If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target RouterDISADPMS TargetRouter510The SA must carefully plan and configure or let IGP determine what goes into each tunnel.
Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route.
Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.Control plane protection is not enabled.<GroupDescription></GroupDescription>NET0966Control plane protection is not enabled.<VulnDiscussion>The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages.
In addition to control plane and management plane traffic that is in the router’s receive path, the RP must also handle other traffic that must be punted to the RP—that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic.
Using the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.
</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.There are numerous rate limiters built into both the Packet Forwarding Engine and the RE to manage exception traffic to and from the RE. Traffic destined to the system is prioritized upon receipt based on protocol in the PFE (forwarding plane). Legitimate traffic bound for the RE is throttled and queued based on protocol priority and appropriately scheduled for transmission across the PFE to RE interface. Juniper is unique. For the most part, ICMP processing is processed by the PFE. This is especially helpful for packets with a next-hop of discard. The forwarding board generates the ICMP unreachable, not the routing engine. These mechanisms aren't configurable and have always been part of the Juniper M/T series architecture. In addition, Juniper handles fragmentation in the data plane, not the RE.
Step 1: Verify that an inbound filter has been applied to the loopback interface to restrict traffic destined to the router. The interface configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
no-redirects;
filter {
input router-protect-filter;
}
address 10.10.2.1/32
}
}
}
}
Step 2: Verify the filter bound to the router’s loopback address restricts all control plane and management plane traffic. The filter configuration should look similar to the following:
firewall {
filter router-protect-filter {
/* police management and ICMP traffic */
policer mgmt-128k {
if-exceeding {
bandwidth-limit 128k;
burst-size-limit 2k;
}
then discard;
}
policer mgmt-64k {
if-exceeding {
bandwidth-limit 64k;
burst-size-limit 1k;
}
then discard;
}
policer icmp-64k {
if-exceeding {
bandwidth-limit 64k;
burst-size-limit 1k;
}
then discard;
}
/* drop framgmented ICMP messages */
term fragmented-icmp {
from {
protocol icmp;
is-fragment;
}
then {
syslog;
discard;
}
}
/* allow specific management plane traffic */
term ssh-access {
from {
source-address {
192.168.1.0/24;
}
protocol tcp;
destination-port ssh;
}
then {
policer mgmt-64k;
accept;
}
}
term snmp-access {
from {
source-address {
192.168.1.22/32;
192.168.1.24/32;
}
protocol udp;
destination-port snmp;
}
then {
policer mgmt-128k;
accept;
}
}
term tacacs-access {
from {
source-address {
192.168.1.101/32;
}
protocol tcp;
port tacacs-ds;
}
then {
policer mgmt-64k;
accept;
}
}
term ntp-access {
from {
source-address {
192.168.1.70/32;
192.168.1.77/32;
}
protocol udp;
port ntp;
}
then {
policer mgmt-64k;
accept;
}
}
term allow-ICMP {
from {
source-address {
192.168.1.0/24;
}
protocol icmp;
}
then {
policer icmp-64k;
accept;
}
}
/* allow specific control plane traffic */
term guard-bgp {
from {
source-address {
199.21.32.11/32;
199.21.32.12/32;
}
protocol tcp;
port bgp;
}
then {
syslog;
accept;
}
}
term guard-ospf {
from {
source-address {
199.21.32.11/32;
199.21.32.12/32;
}
protocol ospf;
}
then {
syslog;
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}
No Admin-local or Site-local boundary<GroupDescription></GroupDescription>NET-MCAST-010Long Name: The administrator must ensure that multicast routers are configured to establish
boundaries for Admin-local or Site-local scope multicast traffic.<VulnDiscussion>A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces."
Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.The following examples will establish a multicast boundary on the interface to ensure that Local-scope IPv4 traffic or Site-local scope IPv6 traffic is not allowed into or out of the administratively scoped multicast region. You can configure multicast scoping with a scope statement or with a scope-policy statement as shown in the examples.
Example using the scope statement
routing-options {
multicast {
scope ipv4-administrative-scope {
interface [fe-1/1/1 fe-1/1/2];
prefix 239.255.0.0/16;
}
scope ipv6-administrative-scope {
interface [fe-1/1/1 fe-1/1/2];
prefix FF05::/16;
}
}
}
Example using the scope-policy statement
routing-options {
multicast {
scope-policy block-admin-scope;
}
}
.
.
.
policy-options {
policy-statement block-admin-scope {
term reject-i {
from {
route-filter 239.255.0.0/16 orlonger;
route-filter FF08::/16 orlonger;
}
then reject;
}
}
}
Two NTP servers are not used to synchronize time.<GroupDescription></GroupDescription>NET0812The network element must use two or more NTP servers to synchronize time.<VulnDiscussion>Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to use two separate NTP servers.Review the router or switch configurations and verify that two or more NTP servers have been defined similar to the following example:
[edit system]
ntp {
boot-server 129.237.32.2;
server 129.237.32.2;
server 142.181.31.6;
}
Note: The boot-server statement identifies the server from which the initial time of day and date is obtained when the router boots. The server statements identify the NTP servers used for periodic time synchronization.
Call home service is disabled.<GroupDescription></GroupDescription>NET0405A service or feature that calls home to the vendor must be disabled.<VulnDiscussion>Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><Responsibility>Network Security Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the network device to disable the call home service or feature.Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding.PIM enabled on wrong interfaces<GroupDescription></GroupDescription>NET-MCAST-001The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.<VulnDiscussion>A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM.
Review the interfaces that have been defined under the protocols PIM hierarchy and verify that they all need to support multicast routing. When using the explicit interface declarations, the configuration would look similar to the following:
protocols {
pim {
interface so-7/0/1.0 {
mode sparse;
version 2;
}
interfaces ge-0/3/0.0 {
mode sparse;
version 2;
}
…
…
…
}
If the interface all statement is used, verify that interfaces not supporting multicast routing have PIM disabled using the disable keyword. The configuration would look similar to the following:
protocols {
pim {
interface all {
mode sparse;
version 2;
}
interface fx0.0 {
disable;
}
interfaces fe-1/1/1 {
disable;
}
interfaces fe-1/1/2 {
disable;
}
}
}
PIM neighbor filter is not configured<GroupDescription></GroupDescription>NET-MCAST-002The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.<VulnDiscussion>Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram. JUNOS does not have a PIM neighbor filter; Hence, a firewall filter will have to be used similar to the example shown below.
Step 1: Verify that an input filter is configured that will specify the allowable PIM neighbors similar to the following example.
firewall {
filter input-filter {
term pim-neighbors {
from {
source-address {
192.0.2.1/32;
192.0.2.3/32;
}
destination-address {
224.0.0.13/32;
}
protocol pim;
}
then accept;
}
term …
Step 2: Verify that an input filter is applied to all PIM enabled interfaces. The configuration should look similar to the following:
interfaces fe-1/1/1 {
unit 0 {
family inet {
filter {
input input-filter;
}
address 192.0.2.2/32;
}
}
}
To determine which interfaces are enabled for PIM, review the interface section within the protocols pim hierarchy that will look similar to the following example:
protocols {
…
pim {
interface all {
mode sparse;
}
}
}
Maximum hop limit is less than 32<GroupDescription></GroupDescription>NET-IPV6-059The administrator must ensure that the maximum hop limit is at least 32.<VulnDiscussion>The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure maximum hop limit to at least 32.Review the router or multi-layer switch configuration to determine if the default maximum hop limit has been configured. If it has been configured, then it must be set to at least 32.
protocols {
…
…
router-advertisement {
interface [fe-1/1/1 fe-1/1/2] {
current-hop-limit 128;
}
…
}
}
Note: The JUNOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.
The 6-to-4 router is not filtering protocol 41<GroupDescription></GroupDescription>NET-IPV6-065The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network. <VulnDiscussion>The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable6-to-4 router not filtering invalid source address<GroupDescription></GroupDescription>NET-IPV6-066The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.<VulnDiscussion>An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable
L2TPv3 sessions are not authenticated<GroupDescription></GroupDescription>NET-TUNL-034The administrator must ensure the that all L2TPv3 sessions are authenticated prior to transporting traffic.<VulnDiscussion>L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure L2TPv3 to use authentication for any peering sessions.Currently JUNOS does not support L2TPv3 so this vulnerability is not applicable.BGP must authenticate all peers.<GroupDescription></GroupDescription>NET0408The network element must authenticate all BGP peers within the same or between autonomous systems (AS).<VulnDiscussion>As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet—including RST flags.
One way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target RouterDISADPMS TargetRouter510Configure the device to authenticate all BGP peers.Review the router configuration to determine if authentication is being used for all peers. An authentication key should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example:
protocols bgp {
group external-peers {
type external;
neighbor 171.69.232.90 {
peer-as 200;
authentication-key xxxxx;
}
neighbor 171.69.232.100 {
peer-as 300;
authentication-key xxxxx;
}
}
}
Note: The authentication-key statement can be applied at the BGP level, at the group level, or at the neighbor level.