STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to authenticate all received MSDP packets.

DISA Rule

SV-254029r844120_rule

Vulnerability Number

V-254029

Group Title

SRG-NET-000343-RTR-000002

Rule Version

JUEX-RT-000570

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Ensure all MSDP packets received by an MSDP router are authenticated.

set protocols msdp active-source-limit maximum <1..1000000>
set protocols msdp active-source-limit threshold <1..1000000>
set protocols msdp active-source-limit log-warning <percent to log warning>
<additional configuration>
set protocols msdp peer <address> authentication-key <PSK>

Check Contents

Review the router configuration to determine if received MSDP packets are authenticated.

[edit protocols]
msdp {
active-source-limit {
maximum <1..1000000>;
threshold <1..1000000>;
log-warning <percent to log warning>;
}
<additional configuration>
peer <address> {
authentication-key "hashed PSK"; ## SECRET-DATA
}
}

If the router does not require MSDP authentication, this is a finding.

Vulnerability Number

V-254029

Documentable

False

Rule Version

JUEX-RT-000570

Severity Override Guidance

Review the router configuration to determine if received MSDP packets are authenticated.

[edit protocols]
msdp {
active-source-limit {
maximum <1..1000000>;
threshold <1..1000000>;
log-warning <percent to log warning>;
}
<additional configuration>
peer <address> {
authentication-key "hashed PSK"; ## SECRET-DATA
}
}

If the router does not require MSDP authentication, this is a finding.

Check Content Reference

M

Target Key

5479