STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper BGP router must be configured to use the prefix limit feature to protect against route table flooding and prefix deaggregation attacks.

DISA Rule

SV-254037r844144_rule

Vulnerability Number

V-254037

Group Title

SRG-NET-000362-RTR-000117

Rule Version

JUEX-RT-000650

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure all eBGP routers to use the prefix limit feature to protect against route table flooding and prefix deaggregation attacks.

set protocols bgp group <group name> type external
set protocols bgp group <group name> local-as <local AS number>
set protocols bgp group <group name> neighbor <neighbor 1 address> family inet unicast prefix-limit maximum 10
set protocols bgp group <group name> neighbor <neighbor 1 address> family inet unicast prefix-limit teardown
set protocols bgp group <group name> neighbor <neighbor 1 address> family inet6 unicast prefix-limit maximum 10
set protocols bgp group <group name> neighbor <neighbor 1 address> family inet6 unicast prefix-limit teardown
set protocols bgp group <group name> neighbor <neighbor 1 address> authentication-key <PSK value>
set protocols bgp group <group name> neighbor <neighbor 2 address> family inet unicast prefix-limit maximum 10
set protocols bgp group <group name> neighbor <neighbor 2 address> family inet unicast prefix-limit teardown
set protocols bgp group <group name> neighbor <neighbor 2 address> family inet6 unicast prefix-limit maximum 10
set protocols bgp group <group name> neighbor <neighbor 2 address> family inet6 unicast prefix-limit teardown
set protocols bgp group <group name> neighbor <neighbor 2 address> ipsec-sa <SA name>

Check Contents

Review the router configuration to verify that the number of received prefixes from each eBGP neighbor is controlled.

[edit protocols]
bgp {
group <group name> {
type external;
local-as <local AS number>;
neighbor <neighbor 1 address> {
family inet {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
family inet6 {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA
}
neighbor <neighbor 2 address> {
family inet {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
family inet6 {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
ipsec-sa <SA name>;
}
}
}

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Vulnerability Number

V-254037

Documentable

False

Rule Version

JUEX-RT-000650

Severity Override Guidance

Review the router configuration to verify that the number of received prefixes from each eBGP neighbor is controlled.

[edit protocols]
bgp {
group <group name> {
type external;
local-as <local AS number>;
neighbor <neighbor 1 address> {
family inet {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
family inet6 {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA
}
neighbor <neighbor 2 address> {
family inet {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
family inet6 {
unicast {
prefix-limit {
maximum 10;
teardown;
}
}
}
ipsec-sa <SA name>;
}
}
}

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Check Content Reference

M

Target Key

5479