STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

DISA Rule

SV-254026r945862_rule

Vulnerability Number

V-254026

Group Title

SRG-NET-000230-RTR-000002

Rule Version

JUEX-RT-000540

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-002205 - Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.

Weight

10

Fix Recommendation

Configure all eBGP routers with unique keys for each eBGP neighbor that it peers with.

set security ipsec security-association <sa name> manual direction bidirectional protocol esp
set security ipsec security-association <sa name> manual direction bidirectional spi <SPI value>
set security ipsec security-association <sa name> manual direction bidirectional authentication algorithm hmac-sha-256-128
set security ipsec security-association <sa name> manual direction bidirectional authentication key ascii-text <PSK value>

set protocols bgp group <group name> type external
set protocols bgp group <group name> local-as <local AS number>
set protocols bgp group <group name> neighbor <neighbor 1 address> authentication-key <PSK value>
set protocols bgp group <group name> neighbor <neighbor 2 address> ipsec-sa test

Check Contents

Interview the ISSM and router administrator to determine if unique keys are being used.

[edit security ipsec]
security-association <sa name> {
manual {
direction bidirectional {
protocol esp;
spi <SPI value>;
authentication {
algorithm hmac-sha-256-128;
key ascii-text "$8$aes256-gcm$hmac-sha2-256$100$SpJ/ERRFEsc$y1Wqf1zM3d3xI+ZVB9WzTw$lgM06LJZN3FcVbTaSkDz4g$bZVi57MkUWg"; ## SECRET-DATA
}
}
}
}
[edit protocols bgp]
group <group name> {
type external;
local-as <local AS number>;
neighbor <neighbor 1 address> {
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA
}
neighbor <neighbor 2 address> {
ipsec-sa <sa name>;
}
}

Note: Juniper BGP routers support either an MD5 key, rotating MD5 keys, or an IPsec security association (SA). Verify the PSK for each MD5 and SA is different between all neighbors.

If unique keys are not being used, this is a finding.

Vulnerability Number

V-254026

Documentable

False

Rule Version

JUEX-RT-000540

Severity Override Guidance

Interview the ISSM and router administrator to determine if unique keys are being used.

[edit security ipsec]
security-association <sa name> {
manual {
direction bidirectional {
protocol esp;
spi <SPI value>;
authentication {
algorithm hmac-sha-256-128;
key ascii-text "$8$aes256-gcm$hmac-sha2-256$100$SpJ/ERRFEsc$y1Wqf1zM3d3xI+ZVB9WzTw$lgM06LJZN3FcVbTaSkDz4g$bZVi57MkUWg"; ## SECRET-DATA
}
}
}
}
[edit protocols bgp]
group <group name> {
type external;
local-as <local AS number>;
neighbor <neighbor 1 address> {
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA
}
neighbor <neighbor 2 address> {
ipsec-sa <sa name>;
}
}

Note: Juniper BGP routers support either an MD5 key, rotating MD5 keys, or an IPsec security association (SA). Verify the PSK for each MD5 and SA is different between all neighbors.

If unique keys are not being used, this is a finding.

Check Content Reference

M

Target Key

5479