STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

DISA Rule

SV-254002r904444_rule

Vulnerability Number

V-254002

Group Title

SRG-NET-000168-RTR-000078

Rule Version

JUEX-RT-000300

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure routing protocol authentication to use a NIST-validated FIPS 198-1 message authentication code algorithm.

Configure the IPsec SA:
set security ipsec security-association <SA name> mode transport
set security ipsec security-association <SA name> manual direction bidirectional protocol (ah | esp | bundle)
set security ipsec security-association <SA name> manual direction bidirectional spi <manually configured SPI (256..16639)>
set security ipsec security-association <SA name> manual direction bidirectional authentication algorithm (hmac-sha1-96 | hmac-sha-256-128)
set security ipsec security-association <SA name> manual direction bidirectional authentication key hexadecimal "<appropriate PSK>"
Note: Encryption keys can also be entered as ASCII with the keyword 'ascii-text' replacing 'hexadecimal'. Regardless of key type, the PSK is hashed in the configuration.

Configure EGP / IGP to use IPsec SA for authentication:
set protocols bgp group <BGP group name> neighbor <IPv4 neighbor address> ipsec-sa <SA name>
set protocols bgp group <BGP group name> neighbor <IPv6 neighbor address> ipsec-sa <SA name>

set protocols ospf area <OSPFv2 area number> interface <interface name>.<logical unit> ipsec-sa <SA name>

set protocols ospf3 area <OSPFv3 area number> interface <interface name>.<logical unit> ipsec-sa <SA name>

NOTE: Versions of Junos not supporting RFC5709 must be configured to use MD5 authentication, but this is still a CAT III finding since MD5 is not compliant.

Check Contents

Verify routing protocol authentication is enabled using a FIPS 198-1 validated hashed message authentication code (HMAC).

For protocols supporting IPsec SA:
[edit security ipsec]
security-association <SA name> {
<snip>

NOTE: Versions of Junos not supporting RFC5709 must be configured to use MD5 authentication, but this is still a CAT III finding since MD5 is not compliant.
For protocols not supporting IPsec SA (OSPFv2 example shown)
[edit protocols ospf]
area <area number> {
interface <name> {
authentication {
<algorithm> <key number> key “<hashed value>”;
}
}
}


If a NIST-validated FIPS 198-1 message authentication code algorithm is not being used to authenticate routing protocols, this is a finding.
Routing protocols using authentication with non-NIST-validated FIPS 198-1 algorithms may be downgraded to CAT III.

Vulnerability Number

V-254002

Documentable

False

Rule Version

JUEX-RT-000300

Severity Override Guidance

Verify routing protocol authentication is enabled using a FIPS 198-1 validated hashed message authentication code (HMAC).

For protocols supporting IPsec SA:
[edit security ipsec]
security-association <SA name> {
<snip>

NOTE: Versions of Junos not supporting RFC5709 must be configured to use MD5 authentication, but this is still a CAT III finding since MD5 is not compliant.
For protocols not supporting IPsec SA (OSPFv2 example shown)
[edit protocols ospf]
area <area number> {
interface <name> {
authentication {
<algorithm> <key number> key “<hashed value>”;
}
}
}


If a NIST-validated FIPS 198-1 message authentication code algorithm is not being used to authenticate routing protocols, this is a finding.
Routing protocols using authentication with non-NIST-validated FIPS 198-1 algorithms may be downgraded to CAT III.

Check Content Reference

M

Target Key

5479