STIGViewer Support

The Juniper BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253975JUEX-RT-000030SV-253975r843958_ruleCCI-001368medium
Description
Accepting route advertisements belonging to the local AS can result in traffic looping, being black holed, or at a minimum using a nonoptimized path.
STIGDate
Juniper EX Series Switches Router Security Technical Implementation Guide2024-06-10

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-04Network Diagrams & Data Flow Diagrams (DFDs)
1.00
AST-04.2Control Applicability Boundary Graphical Representation
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
DCH-19Geographic Location of Data
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
IAC-21Least Privilege
1.00

+7 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+32 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.3
1.00
CCI1 mapping
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

Who does this work

18 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-253975r843958_chk)

Review the BGP router configuration to verify that it will reject routes belonging to the local AS. Example route-filter-list of local AS addresses with corresponding policy-statement referencing the list. Verify the routes are appropriate for the target environment. [edit policy-options] route-filter-list local-routes { 192.0.2.0/24 orlonger; 192.0.3.0/24 orlonger; } route-filter-list local-routes-ipv6 { 2001:db8:2::/64 orlonger; 2001:db8:3::/64 orlonger; } policy-statement bgp-discard { term 1 { from { route-filter-list bogon; route-filter-list bogon-ipv6; } then reject; } term 2 { from { route-filter-list local-routes; route-filter-list local-routes-ipv6; } then reject; } term 3 { from protocol [ ospf direct ]; then reject; } } The example shows using route-filter-lists to ease management. The policy-statement also supports the route directly in the match condition. For example, "route-filter 192.0.2.0/24 orlonger" (in place of route-filter-list local-routes). Note: To reject routes learned via OSPF or directly-connected routes, include a term with a protocol (OSPF and directly-connected routes shown). The policy-statement includes the Bogon term to demonstrate adding terms to a policy without affecting existing terms. The prefix filter must be referenced inbound on the appropriate BGP neighbor statements. Verify the eBGP import statement prevents Junos from importing routes into the route table. Junos accepts import statements at three hierarchy levels: Global protocol, group, and neighbor (peer). Global is the most general, followed by group, and neighbor is the most restrictive. Junos applies only the most restrictive policy so if a policy is configured at the protocol, group, and neighbor level, only the neighbor policy is applied. [edit protocols bgp] group eBGP { <other group configuration> import bgp-discard; neighbor 192.0.2.2 { <other neighbor configuration> import bgp-discard; } } import bgp-discard; <other BGP configuration> If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Fix Text (F-57378r843957_fix)

Ensure all eBGP routers are configured to reject inbound route advertisements for any prefixes belonging to the local AS. set policy-options route-filter-list local-routes 192.0.2.0/24 orlonger set policy-options route-filter-list local-routes 192.0.3.0/24 orlonger set policy-options route-filter-list local-routes-ipv6 2001:db8:2::/64 orlonger set policy-options route-filter-list local-routes-ipv6 2001:db8:3::/64 orlonger set policy-options policy-statement bgp-discard term 1 from route-filter-list bogon set policy-options policy-statement bgp-discard term 1 from route-filter-list bogon-ipv6 set policy-options policy-statement bgp-discard term 1 then reject set policy-options policy-statement bgp-discard term 2 from route-filter-list local-routes set policy-options policy-statement bgp-discard term 2 from route-filter-list local-routes-ipv6 set policy-options policy-statement bgp-discard term 2 then reject set policy-options policy-statement bgp-discard term 3 from protocol ospf set policy-options policy-statement bgp-discard term 3 from protocol direct set policy-options policy-statement bgp-discard term 3 then reject set protocols bgp group eBGP import bgp-discard set protocols bgp group eBGP neighbor 192.0.2.2 import bgp-discard set protocols bgp import bgp-discard