STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

DISA Rule

SV-254027r945863_rule

Vulnerability Number

V-254027

Group Title

SRG-NET-000230-RTR-000003

Rule Version

JUEX-RT-000550

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-002205 - Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

For each authenticated routing protocol session, configure each key to have a lifetime of no more than 180 days.

set security authentication-key-chains key-chain <name> key <number-1> secret <key value>
set security authentication-key-chains key-chain <name> key <number-1> start-time <YYYY-MM-DD.HH:MM>
set security authentication-key-chains key-chain <name> key <number-1> algorithm md5
set security authentication-key-chains key-chain <name> key <number-2> secret <key value>
set security authentication-key-chains key-chain <name> key <number-2> start-time <YYYY-MM-DD.HH:MM>
set security authentication-key-chains key-chain <name> key <number-2> algorithm md5

set protocols bgp group <name> authentication-key-chain <name>
set protocols bgp group <name> neighbor <neighbor address> authentication-key-chain <name>
set protocols bgp authentication-key-chain <name>

set protocols ospf area <area number> interface <interface name>.<logical unit> authentication md5 <number> key <key value>
set protocols ospf area <area number> interface <interface name>.<logical unit> authentication md5 <number> start-time <YYYY-MM-DD.HH:MM>
set protocols ospf area <area number> interface <interface name>.<logical unit> authentication md5 <number> key <key value>
set protocols ospf area <area number> interface <interface name>.<logical unit> authentication md5 <number> start-time <YYYY-MM-DD.HH:MM>

Check Contents

This requirement is not applicable for the DODIN Backbone.

For each authenticated routing protocol session, review the configured key expiration dates.
[edit security]
authentication-key-chains {
key-chain <name> {
key 1 {
secret "$9$vNbM7Vg4ZjkPJGn/AtOB7-d"; ## SECRET-DATA
start-time "2021-1-1.00:00:00 -0700";
algorithm md5;
}
key 2 {
secret "$9$MAQL7VgoGqmTwYmTz3tpWLxNwY4aZjk."; ## SECRET-DATA
start-time "2021-5-31.00:00:00 -0700";
algorithm md5;
}
}
}
[edit protocols]
bgp {
group eBGP {
authentication-key-chain <name>;
neighbor 1.2.3.4 {
authentication-key-chain <name>;
}
}
authentication-key-chain <name>;
}

Note: BGP supports authentication globally, at the group level, and individually for each neighbor. The most specific authentication configuration is applied.
ospf {
area 0.0.0.2 {
interface ge-0/0/0.0 {
authentication {
md5 0 key "$9$vG08xd24Zk.5bs.5QFAtM8X7bsgoJDHq" start-time "2021-1-1.00:00:00 -0700"; ## SECRET-DATA
md5 1 key "$9$m5z6p0IreW9AeWLxwsP5QF9AuO1hyl" start-time "2021-5-31.00:00:00 -0700"; ## SECRET-DATA
}
}
}
}

If any key has a lifetime of more than 180 days, this is a finding.

Vulnerability Number

V-254027

Documentable

False

Rule Version

JUEX-RT-000550

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

For each authenticated routing protocol session, review the configured key expiration dates.
[edit security]
authentication-key-chains {
key-chain <name> {
key 1 {
secret "$9$vNbM7Vg4ZjkPJGn/AtOB7-d"; ## SECRET-DATA
start-time "2021-1-1.00:00:00 -0700";
algorithm md5;
}
key 2 {
secret "$9$MAQL7VgoGqmTwYmTz3tpWLxNwY4aZjk."; ## SECRET-DATA
start-time "2021-5-31.00:00:00 -0700";
algorithm md5;
}
}
}
[edit protocols]
bgp {
group eBGP {
authentication-key-chain <name>;
neighbor 1.2.3.4 {
authentication-key-chain <name>;
}
}
authentication-key-chain <name>;
}

Note: BGP supports authentication globally, at the group level, and individually for each neighbor. The most specific authentication configuration is applied.
ospf {
area 0.0.0.2 {
interface ge-0/0/0.0 {
authentication {
md5 0 key "$9$vG08xd24Zk.5bs.5QFAtM8X7bsgoJDHq" start-time "2021-1-1.00:00:00 -0700"; ## SECRET-DATA
md5 1 key "$9$m5z6p0IreW9AeWLxwsP5QF9AuO1hyl" start-time "2021-5-31.00:00:00 -0700"; ## SECRET-DATA
}
}
}
}

If any key has a lifetime of more than 180 days, this is a finding.

Check Content Reference

M

Target Key

5479