STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The router providing MPLS L2VPN services must be configured to authenticate targeted LDP sessions used to exchange VC information using a FIPS-approved message authentication code algorithm.

DISA Rule

SV-254028r844260_rule

Vulnerability Number

V-254028

Group Title

SRG-NET-000343-RTR-000001

Rule Version

JUEX-RT-000560

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Implement authentication for all targeted LDP sessions using a FIPS-approved message authentication code algorithm.

set protocols ldp interface <interface 1 name>.<logical unit>
set protocols ldp interface <interface 2 name>.<logical unit>
set protocols ldp session <Session destination address> authentication-algorithm <aes-128-cmac-96|hmac-sha-1-96>
set protocols ldp session <Session destination address> authentication-key-chain <name>

Check Contents

Review the router configuration to determine if LDP messages are being authenticated for the targeted LDP sessions.

[edit protocols]
ldp {
interface <interface 1 name>.<logical unit>;
interface <interface 2 name>.<logical unit>;
session <Session destination address> {
authentication-algorithm <aes-128-cmac-96|hmac-sha-1-96>;
authentication-key-chain <name>;
}
}

If authentication is not being used for the LDP sessions using a FIPS-approved message authentication code algorithm, this is a finding.

Vulnerability Number

V-254028

Documentable

False

Rule Version

JUEX-RT-000560

Severity Override Guidance

Review the router configuration to determine if LDP messages are being authenticated for the targeted LDP sessions.

[edit protocols]
ldp {
interface <interface 1 name>.<logical unit>;
interface <interface 2 name>.<logical unit>;
session <Session destination address> {
authentication-algorithm <aes-128-cmac-96|hmac-sha-1-96>;
authentication-key-chain <name>;
}
}

If authentication is not being used for the LDP sessions using a FIPS-approved message authentication code algorithm, this is a finding.

Check Content Reference

M

Target Key

5479