STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).

DISA Rule

SV-254044r997536_rule

Vulnerability Number

V-254044

Group Title

SRG-NET-000362-RTR-000124

Rule Version

JUEX-RT-000720

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

Configure all Exterior Border Gateway Protocol peering sessions to use GTSM.

set firewall family inet filter gtsm term 1 from protocol tcp
set firewall family inet filter gtsm term 1 from ttl 255
set firewall family inet filter gtsm term 1 from destination-port bgp
set firewall family inet filter gtsm term 1 then accept
set firewall family inet filter gtsm term 2 from protocol tcp
set firewall family inet filter gtsm term 2 from destination-port bgp
set firewall family inet filter gtsm term 2 then log
set firewall family inet filter gtsm term 2 then syslog
set firewall family inet filter gtsm term 2 then discard
<additional accept terms>
set firewall family inet filter gtsm term default then log
set firewall family inet filter gtsm term default then syslog
set firewall family inet filter gtsm term default then discard

For those platforms that support 'ttl-except':
set firewall family inet filter gtsm term 1 from protocol tcp
set firewall family inet filter gtsm term 1 from ttl-except 255
set firewall family inet filter gtsm term 1 from destination-port bgp
set firewall family inet filter gtsm term 1 then log
set firewall family inet filter gtsm term 1 then syslog
set firewall family inet filter gtsm term 1 then discard
<additional accept terms>
set firewall family inet filter gtsm term default then log
set firewall family inet filter gtsm term default then syslog
set firewall family inet filter gtsm term default then discard

set interfaces <BGP interface> unit <number> family inet filter input gtsm
set interfaces <BGP interface> unit <number> family inet address <IPv4 address>.<mask>

Check Contents

Review the router configuration. Verify a firewall filter term discards BGP packets with a TTL less than 255.
[edit firewall family inet]
filter gtsm {
term 1 {
from {
protocol tcp;
ttl 255;
destination-port bgp;
}
then accept;
}
term 2 {
from {
protocol tcp;
destination-port bgp;
}
then {
log;
syslog;
discard;
}
}
<additional accept terms>
term default {
then {
log;
syslog;
discard;
}
}
}

Some routers support the "ttl-except" directive that can replace the two term filter shown above. For example:
[edit firewall family inet]
filter gtsm {
term 1 {
from {
protocol tcp;
ttl-except 255;
destination-port bgp;
}
then {
log;
syslog;
discard;
}
}
<additional accept terms>
term default {
then {
log;
syslog;
discard;
}
}
}

Verify the filter is applied to BGP neighbor interfaces.
[edit interfaces]
<bgp interface> {
unit <number> {
family inet {
filter input gtsm;
}
address <IPv4 address>.<mask>;
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If the router is not configured to use GTSM for all Exterior Border Gateway Protocol peering sessions, this is a finding.

Vulnerability Number

V-254044

Documentable

False

Rule Version

JUEX-RT-000720

Severity Override Guidance

Review the router configuration. Verify a firewall filter term discards BGP packets with a TTL less than 255.
[edit firewall family inet]
filter gtsm {
term 1 {
from {
protocol tcp;
ttl 255;
destination-port bgp;
}
then accept;
}
term 2 {
from {
protocol tcp;
destination-port bgp;
}
then {
log;
syslog;
discard;
}
}
<additional accept terms>
term default {
then {
log;
syslog;
discard;
}
}
}

Some routers support the "ttl-except" directive that can replace the two term filter shown above. For example:
[edit firewall family inet]
filter gtsm {
term 1 {
from {
protocol tcp;
ttl-except 255;
destination-port bgp;
}
then {
log;
syslog;
discard;
}
}
<additional accept terms>
term default {
then {
log;
syslog;
discard;
}
}
}

Verify the filter is applied to BGP neighbor interfaces.
[edit interfaces]
<bgp interface> {
unit <number> {
family inet {
filter input gtsm;
}
address <IPv4 address>.<mask>;
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If the router is not configured to use GTSM for all Exterior Border Gateway Protocol peering sessions, this is a finding.

Check Content Reference

M

Target Key

5479