STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper MPLS router must be configured to synchronize IGP and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

DISA Rule

SV-254062r844219_rule

Vulnerability Number

V-254062

Group Title

SRG-NET-000512-RTR-000003

Rule Version

JUEX-RT-000900

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

set protocols ospf area <number> interface <name>.<logical unit> authentication md5 <key number> <PSK>
set protocols ospf area <number> interface <name>.<logical unit> ldp-synchronize hold-time 10
set protocols ldp interface <name>.<logical unit>

-OR-

set protocols isis level 1 authentication-key-chain <name>
set protocols isis level 2 authentication-key-chain <name>
set protocols isis interface <name>.<logical unit> ldp-synchronize hold-time 10
set protocols mpls interface <name>.<logical unit>

Check Contents

Review the router OSPF or IS-IS configuration.

Verify that LDP will synchronize with the link-state routing protocol.
[edit protocols]
ospf {
area <number> {
interface <name>.<logical unit> {
authentication {
md5 <key number> key "$8$aes256-gcm$hmac-sha2-256$100$LfJ7NdAYx/0$+4wGg1QJKLzkaAmVCGxBUQ$n0XxNofUtXE8aoJBhFNDDQ$uIDW/H+VY6U"; ## SECRET-DATA
}
ldp-synchronization {
hold-time 10;
}
}
interface <name>.<logical unit> {
ipsec-sa <name>;
ldp-synchronization {
hold-time 10;
}
}
}
}
ldp {
interface <name>.<logical unit>;
}
-OR-
isis {
interface <name>.<logical unit> {
ldp-synchronization {
hold-time 10;
}
}
level 1 authentication-key-chain <name>;
level 2 authentication-key-chain <name>;
}
mpls {
interface <name>.<logical unit>;
}

If the router is not configured to synchronize IGP and LDP, this is a finding.

Vulnerability Number

V-254062

Documentable

False

Rule Version

JUEX-RT-000900

Severity Override Guidance

Review the router OSPF or IS-IS configuration.

Verify that LDP will synchronize with the link-state routing protocol.
[edit protocols]
ospf {
area <number> {
interface <name>.<logical unit> {
authentication {
md5 <key number> key "$8$aes256-gcm$hmac-sha2-256$100$LfJ7NdAYx/0$+4wGg1QJKLzkaAmVCGxBUQ$n0XxNofUtXE8aoJBhFNDDQ$uIDW/H+VY6U"; ## SECRET-DATA
}
ldp-synchronization {
hold-time 10;
}
}
interface <name>.<logical unit> {
ipsec-sa <name>;
ldp-synchronization {
hold-time 10;
}
}
}
}
ldp {
interface <name>.<logical unit>;
}
-OR-
isis {
interface <name>.<logical unit> {
ldp-synchronization {
hold-time 10;
}
}
level 1 authentication-key-chain <name>;
level 2 authentication-key-chain <name>;
}
mpls {
interface <name>.<logical unit>;
}

If the router is not configured to synchronize IGP and LDP, this is a finding.

Check Content Reference

M

Target Key

5479