STIGQter: STIG Summary: VMware NSX 4.x Tier-0 Gateway Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Tier-0 Gateway router must be configured to implement message authentication for all control plane protocols.

DISA Rule

SV-265431r994643_rule

Vulnerability Number

V-265431

Group Title

SRG-NET-000230-RTR-000001

Rule Version

NT0R-4X-000054

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-002205 - Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.

Weight

10

Fix Recommendation

To set authentication for BGP neighbors, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways, and expand the target Tier-0 gateway.

Expand BGP. Next to BGP Neighbors, click on the number present to open the dialog, then select "Edit" on the target BGP Neighbor.

Under Timers & Password, enter a password up to 20 characters, and then click "Save".

To set authentication for OSPF Area definitions, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways, and expand the target Tier-0 gateway.

Expand OSPF. Next to "Area Definition", click on the number present to open the dialog, and then select "Edit" on the target OSPF Area.

Change the Authentication drop-down to Password or MD5, enter a Key ID and/or Password, and then click "Save".

Check Contents

If the Tier-0 Gateway is not using BGP or OSPF, this is Not Applicable.

Since the router does not reveal if a BGP password is configured, interview the router administrator to determine if a password is configured on BGP neighbors.

If BGP neighbors do not have a password configured, this is a finding.

To verify OSPF areas are using authentication, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway expand the "Tier-0 Gateway".

Expand "OSPF", click the number next to "Area Definition", and view the "Authentication" field for each area.

If OSPF area definitions do not have Password or MD5 set for authentication, this is a finding.

Vulnerability Number

V-265431

Documentable

False

Rule Version

NT0R-4X-000054

Severity Override Guidance

If the Tier-0 Gateway is not using BGP or OSPF, this is Not Applicable.

Since the router does not reveal if a BGP password is configured, interview the router administrator to determine if a password is configured on BGP neighbors.

If BGP neighbors do not have a password configured, this is a finding.

To verify OSPF areas are using authentication, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway expand the "Tier-0 Gateway".

Expand "OSPF", click the number next to "Area Definition", and view the "Authentication" field for each area.

If OSPF area definitions do not have Password or MD5 set for authentication, this is a finding.

Check Content Reference

M

Target Key

5634