SV-253928r1167981_rule
V-253928
SRG-APP-000411-NDM-000330
JUEX-NM-000510
CAT I
10
Configure the network device to use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.
set snmp v3 usm local-engine user <SNMPv3 user> authentication-sha authentication-password "PSK"
set snmp v3 usm local-engine user <SNMPv3 user> privacy-aes128 privacy-password "PSK"
Note: Use the strongest HMAC mutually supported with the NMS (e.g., authentication-sha256, authentication-sha512)
set system services ssh protocol-version v2
set system services ssh ciphers aes256-ctr
set system services ssh macs hmac-sha2-512
set system services ssh macs hmac-sha2-256
set system services ssh key-exchange ecdh-sha2-nistp521
set system services ssh key-exchange ecdh-sha2-nistp384
set system services ssh key-exchange ecdh-sha2-nistp256
Verify the network device uses FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.
If using SNMPv3, verify (minimally) that authentication-sha is configured. Juniper devices also support authentication-sha224/256/384/512. Verify the strongest mutually supported HMAC between the network device and the Network Management Server (NMS) is configured.
[edit system snmp]
v3 {
usm {
local-engine {
user <SNMPv3 user> {
authentication-sha {
authentication-key "PSK"; ## SECRET-DATA
}
}
}
}
}
Verify SSHv2 is configured for protocol V2 only, ciphers [ aes256-ctr ], key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ], and macs [ hmac-sha2-512 hmac-sha2-256].
[edit system services ssh]
:
protocol-version v2;
ciphers [ aes256-ctr];
macs [ hmac-sha2-512 hmac-sha2-256 ];
key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ];
If the network device does not use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this is a finding.
V-253928
False
JUEX-NM-000510
Verify the network device uses FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.
If using SNMPv3, verify (minimally) that authentication-sha is configured. Juniper devices also support authentication-sha224/256/384/512. Verify the strongest mutually supported HMAC between the network device and the Network Management Server (NMS) is configured.
[edit system snmp]
v3 {
usm {
local-engine {
user <SNMPv3 user> {
authentication-sha {
authentication-key "PSK"; ## SECRET-DATA
}
}
}
}
}
Verify SSHv2 is configured for protocol V2 only, ciphers [ aes256-ctr ], key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ], and macs [ hmac-sha2-512 hmac-sha2-256].
[edit system services ssh]
:
protocol-version v2;
ciphers [ aes256-ctr];
macs [ hmac-sha2-512 hmac-sha2-256 ];
key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ];
If the network device does not use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this is a finding.
M
5477