Free DISA STIG and SRG Library | Vaulted

Compare Summary

Compare V8R29 to V8R28
  • All
  • Updated 1
  • Added 0
  • Removed 0

Vulnerabilities (79)

Network devices must display the DoD-approved logon banner warning.

Finding ID
NET0340
Rule ID
SV-3013r5_rule3013r4_rule
Severity
Cat II
CCE
(None)
Group Title
Login banner is non-existent or not DOD-approved.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.

Fix Text

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

Check Content

Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.

Responsibility

Information Assurance Officer

Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.

Finding ID
NET0422
Rule ID
SV-15301r4_rule
Severity
Cat III
CCE
(None)
Group Title
Key expiration exceeds 180 days.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.

Fix Text

Configure the device so rotating keys expire at 180 days or less.

Check Content

Review device configuration for key expirations of 180 days or less. If rotating keys are not configured to expire at 180 days or less, this is a finding.

The router administrator will ensure FTP server is disabled.

Finding ID
NET0742
Rule ID
SV-15312r1_rule
Severity
Cat II
CCE
(None)
Group Title
FTP server is not disabled
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.

Fix Text

Disable FTP server services on the device.

Check Content

Review the device configuration to determine if the device has been setup to be an FTP server. If the device has been configured to be an FTP server, this is a finding.

Responsibility

Information Assurance Officer

The network element must have all BSDr commands disabled.

Finding ID
NET0744
Rule ID
SV-15315r2_rule
Severity
Cat II
CCE
(None)
Group Title
BSDr commands are not disabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a "trusted" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods

Fix Text

Configure the device to disable BSDr command services.

Check Content

Under the edit system services hierarchy, enter a show command to verify that the rlogin command is not present.

Responsibility

Information Assurance Officer

The router administrator will ensure ICMPv6 unreachable notifications, and redirects are disabled on all external interfaces of the premise router.

Finding ID
NET0802
Rule ID
SV-15322r1_rule
Severity
Cat II
CCE
(None)
Group Title
ICMPv6 unreachable notifications and redirects must be disabled
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.

Fix Text

The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.

Check Content

Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces.

Responsibility

Information Assurance Officer

The network element must authenticate all NTP messages received from NTP servers and peers.

Finding ID
NET0813
Rule ID
SV-41501r3_rule
Severity
Cat II
CCE
(None)
Group Title
NTP messages are not authenticated.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.

Fix Text

Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.

Check Content

Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Downgrade: If the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III. If the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.

The router must use its loopback or OOB management interface address as the source address when originating TACACS+ or RADIUS traffic.

Finding ID
NET0897
Rule ID
SV-16092r2_rule
Severity
Cat III
CCE
(None)
Group Title
Authentication traffic does not use loopback address or OOB Management interface.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.

Check Content

Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on JUNOS routers; however, multiple addresses can be defined. Step 2: Verify that TACACS+ and RADIUS are configured to use the loopback address by comparing the source address defined for tacplus-server and radius-server with the address configured for the loopback interface. You should find a configuration similar to the examples below: TACACS+ system { tacplus-server { 10.10.2.11; source-address 10.10.2.1; } } RADIUS system { radius-server { 10.10.2.21; source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Responsibility

Information Assurance Officer

The router must use its loopback or OOB management interface address as the source address when originating syslog traffic.

Finding ID
NET0898
Rule ID
SV-15341r2_rule
Severity
Cat III
CCE
(None)
Group Title
Syslog traffic is not using loopback address or OOB management interface.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.

Check Content

Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that syslog is configured to use the loopback address by comparing the source address defined for syslog with the address configured for the loopback interface. You should find a configuration similar to the examples below: system { syslog { host 192.168.1.100 { any info; } source-address 192.168.1.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Responsibility

Information Assurance Officer

The router must use its loopback or OOB management interface address as the source address when originating NTP traffic.

Finding ID
NET0899
Rule ID
SV-15344r2_rule
Severity
Cat III
CCE
(None)
Group Title
NTP traffic is not using loopback address or OOB Management interface.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.

Check Content

Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that NTP is configured to use the loopback address by comparing the source address defined for NTP with the address configured for the loopback interface. You should find a configuration similar to the examples below: system { ntp { server 10.10.2.21; source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Responsibility

Information Assurance Officer

The router must use its loopback or OOB management interface address as the source address when originating SNMP traffic.

Finding ID
NET0900
Rule ID
SV-15347r2_rule
Severity
Cat III
CCE
(None)
Group Title
SNMP traffic does not use loopback address or OOB Management interface.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.

Check Content

Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that SNMP is configured to use the loopback address by comparing the source address defined for SNMP with the address configured for the loopback interface. You should find a configuration similar to the examples below: snmp { clients { default restrict; 10.10.2.111/32; } trap-options { source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Responsibility

Information Assurance Officer

The router must use its loopback or OOB management interface address as the source address when originating NetFlow traffic.

Finding ID
NET0901
Rule ID
SV-15350r2_rule
Severity
Cat III
CCE
(None)
Group Title
Netflow traffic is not using loopback address.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Netflow messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.

Check Content

Review the configuration and verify the loopback interface address is used as the source address when originating Netflow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Juniper has adopted the Cisco PDU format for flow export; However, Juniper does not call it NetFlow but "cflowd" and uses the flow export concept as a means to export packet-sampling data. Juniper has a filtering mechanism which allows you to sample packets and log them to the local file system or they can be exported using the "cflowd" forwarding options. You should find a configuration similar to the example below depicting the source address for cflowd: forwarding-options { sampling { input { family inet { rate 100; run-length 4; max-packets-per-second 5000; } } output { cflowd 10.10.2.22 { port 9991; source-address 10.10.2.1; } } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Responsibility

Information Assurance Officer

The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

Finding ID
NET0902
Rule ID
SV-15353r3_rule
Severity
Cat III
CCE
(None)
Group Title
FTP/TFTP traffic does not use loopback address or OOB Management interface.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.

Fix Text

Configure the network device to use a loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

Check Content

Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address x.x.x.x/32; } } } Step 2: There is no method to override the source address default for TFTP and FTP. Hence, the router must be configured to use the loopback as the default source address for all locally generated traffic. This is accomplished by configuring the default-address-selection statement as shown in the following example: system { default-address-selection; … } } If the device is managed from an OOB management network, the OOB interface must be used instead. Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The router must use its loopback interface address as the source address for all iBGP peering sessions.

Finding ID
NET0903
Rule ID
SV-15360r2_rule
Severity
Cat III
CCE
(None)
Group Title
Loopback address is not used as the iBGP source IP.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.

Fix Text

Configure the network device's loopback address as the source address for iBGP peering.

Check Content

Review the configuration and verify the loopback interface address is used as the source address for all iBGP peering. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: The vulnerability does not require eBGP peering to use the loopback address. Hence, the BGP router only requires that the loopback address is used to peer with its iBGP neighbors. You should find a configuration similar to the example below: protocols { bgp { group iBGP_111 { type internal; local-address 10.10.2.1; export next-hop-self; peer-as 111; neighbor 10.10.2.2; } } }

Responsibility

Information Assurance Officer

The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.

Finding ID
NET-IPV6-025
Rule ID
SV-15397r2_rule
Severity
Cat II
CCE
(None)
Group Title
IPv6 Site Local Unicast ADDR must not be defined
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.

Fix Text

Configure the device using authorized IP addresses.

Check Content

Review the device configuration to ensure FEC0::/10 IP addresses are not defined. If FEC0::/10 IP addresses are defined, this is a finding.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.

Finding ID
NET-IPV6-034
Rule ID
SV-15430r1_rule
Severity
Cat II
CCE
(None)
Group Title
IPv6 Egress Outbound Spoofing Filter
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped. If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address). To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes.

Fix Text

The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.

Check Content

Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.

Responsibility

Information Assurance Officer

The network element must not use SSH Version 1 for administrative access.

Finding ID
NET1647
Rule ID
SV-15461r2_rule
Severity
Cat II
CCE
(None)
Group Title
The network element must not allow SSH Version 1.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.

Fix Text

Configure the network device to use SSH version 2.

Check Content

If SSH is used for administrative access, then Version 2 must be configured as shown in the following example: system { services { ssh { protocol-version v2; } } }

Responsibility

Information Assurance Officer

ISATAP tunnels must terminate at an interior router.

Finding ID
NET-TUNL-017
Rule ID
SV-16067r2_rule
Severity
Cat II
CCE
(None)
Group Title
ISATAP tunnels must terminate at interior router.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.

Fix Text

Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.

Check Content

Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

Network devices must use two or more authentication servers for the purpose of granting administrative access.

Finding ID
NET0433
Rule ID
SV-16259r4_rule
Severity
Cat II
CCE
(None)
Group Title
The device is not authenticated using a AAA server.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.

Fix Text

Configure the device to use two separate authentication servers.

Check Content

Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.

Responsibility

Information Assurance Officer

The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.

Finding ID
NET0441
Rule ID
SV-16261r5_rule
Severity
Cat I
CCE
(None)
Group Title
Emergency administration account privilege level is not set.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.

Fix Text

Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.

Check Content

Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.

Responsibility

Information Assurance Officer

IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.

Finding ID
NET1807
Rule ID
SV-18945r2_rule
Severity
Cat II
CCE
(None)
Group Title
Management traffic is not restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.

Fix Text

Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.

Check Content

Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network. If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.

Responsibility

Information Assurance Officer

Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway

Finding ID
NET1808
Rule ID
SV-19063r1_rule
Severity
Cat II
CCE
(None)
Group Title
Remote VPN end-point not a mirror of local gateway
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

Fix Text

Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

Check Content

Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.

Responsibility

System Administrator

IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain

Finding ID
NET0985
Rule ID
SV-19298r1_rule
Severity
Cat II
CCE
(None)
Group Title
IGP instances do not peer with appropriate domain
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network.

Fix Text

Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.

Check Content

Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where RIP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “Enclave Management LAN” unit 0 { family inet { address 10.1.1.1/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { address 10.1.20.3/24; } } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; interface lo0.0; } } rip { group rip-neighbor { neighbor t3-3/0/3.0; export rip-advertisements; } } } policy-options { policy-statement rip-advertisements { from protocol rip; then accept; } } policy-statement direct-management-LAN { from { protocol direct; interface [ lo0.0 t3-3/0/3.0 fe-0/0/2 ]; } then accept; } } Note: When you enable RIP, the default JUNOS behavior is to accept all learned RIP routes but export no routes to RIP neighbors. To have RIP send routing information to its neighbors, you need to configure a routing policy that has RIP export routes to its neighbors. In the example above, the OOBM gateway router will only have a RIP neighbor adjacency with its upstream OOB backbone router. However, it will advertise to the RIP domain the local management address prefix and the loopback address which also belongs to the management network.

Responsibility

System Administrator

The routes from the two IGP domains are redistributed to each other.

Finding ID
NET0986
Rule ID
SV-19300r1_rule
Severity
Cat II
CCE
(None)
Group Title
Routes from the two IGP domains are redistributed
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other.

Fix Text

Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.

Check Content

Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa. There is no equivalent redistribute command in JUNOS. All redistribution of routes between protocols is done through the creation of a routing policy through the use of import and export statements. Verify that there are no export and policy-statement commands configured that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following example illustrates how RIP routes would be redistributing into OSPF. policy-options { policy-statement rip-to-ospf { from protocol rip; then accept; } } } protocols { ospf { export rip-to-ospf; area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; } } As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well. If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { address 10.1.20.3/24; } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; interface lo0.0; } } routing-options { static { route 10.1.1.0/24 { next-hop 10.1.20.4; } } }

Potential Impact

Responsibility

System Administrator

Traffic from the managed network is able to access the OOBM gateway router

Finding ID
NET0987
Rule ID
SV-19302r2_rule
Severity
Cat II
CCE
(None)
Group Title
Managed network has access to OOBM gateway router
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.

Fix Text

Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.

Check Content

Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic. Step 1: Verify that an inbound filter has been applied to loopback interface. This filter is used to restrict all traffic to the router engine. The interface configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { no-redirects; filter { input router-protect-filter; } address 10.1.3.41/32; } } } } Note: the address block used for loopback addresses should be independent of the address space used for the management backbone, the NOC, or the local management subnet. Loopback address should be configured with /32 prefixes to enable proper route advertisements and optimum path reachability for both control plane and management plane traffic within the global management network. Step 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC. Step 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The filter configuration should look similar to the following: firewall { filter router-protect-filter { term ospf-neighbors { from { source-address { 10.2.2.0/24; } protocol ospf; } then { syslog; accept; } } term ssh-access { from { source-address { 10.2.2.0/24; } protocol tcp; destination-port ssh; } then { syslog; accept; } } term snmp-access { from { source-address { 10.2.2.24/32; 10.2.2.25/32; } protocol udp; destination-port snmp; } then { syslog; accept; } } term tacacs-access { from { source-address { 10.2.2.30/32; } protocol tcp; port tacacs-ds; } then { syslog; accept; } } term ftp-access { from { source-address { 10.2.2.77/32; } protocol tcp; port [ftp ftp-data]; } then { syslog; accept; } } term allow-ICMP { from { source-address { 10.2.2.0/24; } protocol icmp; } then accept; } term default-action { then { syslog; discard; } } } }

Responsibility

System Administrator

Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.

Finding ID
NET0988
Rule ID
SV-19304r1_rule
Severity
Cat II
CCE
(None)
Group Title
Traffic from the managed network will leak
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks.

Fix Text

Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.

Check Content

Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { filter { output OOBM-egress-filter; } address 10.1.20.3/24; } } } } firewall { filter OOBM-egress-filter { term allow-mgmt { from { source-address { 10.1.1.0/24; } destination-address { 10.2.2.0/24; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } }

Responsibility

System Administrator

Management network traffic is leaking into the managed network.

Finding ID
NET0989
Rule ID
SV-19306r1_rule
Severity
Cat II
CCE
(None)
Group Title
Management traffic leaks into the managed network
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network’s production address spaces.

Fix Text

Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.

Check Content

Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { address 10.1.1.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.20.3/24; } } } firewall { filter OOBM-ingress-filter { term allow-mgmt { from { source-address { 10.2.2.0/24; } destination-address { 10.1.1.0/24; } } then { accept; } } … … term default-action { then { syslog; discard; } } } }

Responsibility

System Administrator

The network element’s OOBM interface must be configured with an OOBM network address.

Finding ID
NET0991
Rule ID
SV-20206r2_rule
Severity
Cat II
CCE
(None)
Group Title
The OOBM interface not configured correctly.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.

Fix Text

Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.

Check Content

After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24. interfaces { fxp0 { description “link to OOBM access switch” unit 0 { family inet { address 10.1.1.22/24; } } }

Responsibility

System Administrator

The management interface is not configured with both an ingress and egress ACL.

Finding ID
NET0992
Rule ID
SV-20209r1_rule
Severity
Cat II
CCE
(None)
Group Title
The management interface does not have an ACL.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network

Fix Text

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.

Check Content

Step 1: Verify that the managed interface has an inbound and outbound filter configured as shown in the following example: interfaces { fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.1.22/24; } } } Step 2: Verify that the ingress filter blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24. firewall { filter OOBM-ingress-filter { term allow-mgmt { from { source-address { 10.2.2.0/24; } destination-address { 10.1.1.22/32; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } } Step 3: Verify that the egress filter blocks any traffic exiting the management interface that was not originated by the managed elements . Verify that the destination address is the NOC address space. firewall { filter OOBM-egress-filter { term allow-mgmt { from { source-address { 10.1.1.22/32; } destination-address { 10.2.2.0/24; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } }

Responsibility

System Administrator

The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network.

Finding ID
NET0993
Rule ID
SV-19335r2_rule
Severity
Cat III
CCE
(None)
Group Title
The management interface is not IGP passive.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network.

Fix Text

Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.

Check Content

If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. With JUNOS, routing protocols are enabled on the interfaces by specifying the interface under the routing protocol hierarchy. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface: interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.1.22/24; } } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; } } }

Responsibility

System Administrator

An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.

Finding ID
NET1005
Rule ID
SV-19309r1_rule
Severity
Cat II
CCE
(None)
Group Title
No inbound ACL for mgmt network sub-interface
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other.

Fix Text

If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.

Check Content

Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration: interfaces fe-1/1/1 { vlan-tagging; unit 10 { family inet { filter { input ingress-mgmt-vlan-filter; } address 10.1.1.1/24; } } } firewall { filter ingress-mgmt-vlan-filter { term …

Responsibility

System Administrator

Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.

Finding ID
NET1006
Rule ID
SV-19311r1_rule
Severity
Cat II
CCE
(None)
Group Title
IPSec traffic is not restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services.

Fix Text

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

Check Content

Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). Example from a show services command with Juniper M or T series router with Adaptive Services PIC using next-hop style is as follows: service-set vpn-to-NOC { next-hop-service { inside-service-interface sp-0/0/0.1; outside-service-interface sp-0/0/0.2; } ipsec-vpn-options { local-gateway 19.16.1.1; } ipsec-vpn-rules site-to-NOC; } ipsec-vpn { rule site-to-NOC { term mgmt-traffic { } destination-address { 10.2.2.0/24; } } then remote-gateway 19.16.2.1; dynamic { ike-policy main_mode_ike_policy; ipsec-policy dynamic_ipsec_policy; } } } match-direction input; } ipsec { proposal esp_sha1_ipsec_prop { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm 3des-cbc; } policy dynamic_ipsec_policy { perfect-forward-secrecy { keys group2; } proposals esp_sha1_ipsec_prop; } } ike { proposal psk_sha1_3des_ike_prop { authentication-method pre-shared-keys; authentication-algorithm sha1; encryption-algorithm 3des-cbc; } policy main_mode_ike_policy { mode main; proposals psk_sha1_3des_ike_prop; pre-shared-key ascii-text “$7#$AAtBRmNOjH”; ##SECRET-DATA } } } Note: Juniper recommends implementing all Layer 3 services with the next-hop-style service set as opposed to the interface-style. When you configure next-hop-style service sets, you associate them with specific inside and outside logical interfaces. These logical interfaces are units you configure on an AS PIC’s sp- interface as illustrated below: interfaces { sp-0/0/0 { unit 0 { family inet; } unit 1 { description "IPSec Tunnel Inside Service Interface"; family inet; service-domain inside; } unit 2 { description "IPSec Tunnel Outside Service Interface"; family inet; service-domain outside; } } … … } The router must be configured to match the traffic that is to be secured in the outbound direction. For next-hop service sets, this is the input direction as configured via match-direction input command as shown above under the services ipsec-vpn hierarchy. You configure the router to route traffic to the inside or outside interface as shown in the following example: routing-options { static { route 10.2.2.0/24 next-hop sp-0/0/0.1; } }

Responsibility

System Administrator

Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.

Finding ID
NET1007
Rule ID
SV-19314r1_rule
Severity
Cat III
CCE
(None)
Group Title
Management traffic is not classified and marked
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.

Fix Text

When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.

Check Content

Review the configuration of the MLS or router to determine if the management traffic is classified and marked to a favorable PHB at the distribution layer. According to the DISN approved QoS classifications, control plane and management plane traffic should use DSCP 48 (Network-Control PHB). In the example configurations below, an infrastructure router within the managed network’s distribution layer will classify and mark at ingress all traffic destined to management network with DSCP 48. firewall { family inet { filter set-FC-to-network-control { term match-management-network-prefix { from { destination-address { 10.10.10.0/24; } } then { forwarding-class network-control; accept; } } term accept-all { then accept; } } } } interfaces { fe-0/0/2 { description “link to LAN1” unit 0 { family inet { filter { input set-FC-to-network-control; } address 192.168.1.1/24; } } } fe-0/0/2 { description “link to LAN2” unit 0 { family inet { filter { input set-FC-to-network-control; } address 192.168.2.1/24; } } } ge-0/0/1 { description “link to core” unit 0 { family inet { address 192.168.2.1/24; } } } } By default, rewrite rules are not applied to interfaces. Without rewriting the DSCP value in the packet, the packet will be transmitted with the original value prior to classifying by the local router. To apply a rewrite rule, you can either use the default rules or design new rules. In either case, you must apply the rules to the outgoing interface under the class-of-service hierarchy as shown in the following configuration: class-of-service { interfaces { ge-0/0/1 { unit 0 { rewrite-rules { dscp default; } } } } }

Responsibility

System Administrator

The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.

Finding ID
NET1008
Rule ID
SV-19316r1_rule
Severity
Cat III
CCE
(None)
Group Title
Management traffic doesn't get preferred treatment
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.

Fix Text

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic.

Check Content

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network. Step 1: Verify that all internal or core router interfaces are bound to a DSCP classifier and that both CE-facing and core-facing interfaces have a forwarding-class policy defined (i.e. scheduler-map) as shown in the configuration below: class-of-service { interfaces { fe-* { scheduler-map MAP-FC-Policy; unit 0 { classifiers { dscp access-classifier; } rewrite-rules { dscp basic-rewrite-rules; } } } ge-* { scheduler-map MAP-FC-Policy; unit 0 { classifiers { dscp core-classifier; } } } } } Step 2: Verify that the classifier places traffic in the appropriate forwarding class according to the approved DSCPs as shown in the example below: class-of-service { classifiers { dscp access-classifier { forwarding-class best-effort { loss-priority high code-points 000000; } forwarding-class data-AF13-AF23 { loss-priority high code-points 001110; loss-priority low code-points 010110; } forwarding-class video-AF33-AF43 { loss-priority high code-points 011110; loss-priority low code-points 100110; } forwarding-class voice-EF { loss-priority low code-points 101110; } forwarding-class network-control { loss-priority low code-points 110000; } } } } Step 3: Verify that the forwarding classes are associated with the correct queues and polices (i.e., schedulers) as shown in the example below: class-of-service { forwarding-classes { queue 0 best-effort; queue 1 data-AF13-AF23; queue 2 video-AF33-AF43; queue 3 voice-EF; queue 4 network-control; } scheduler-maps { MAP-FC-Policy { forwarding-class best-effort scheduler Q0-best-effort; forwarding-class data-AF13-AF23 scheduler Q1-data; forwarding-class video-AF33-AF43 scheduler Q2-video; forwarding-class voice-EF scheduler Q3-voice; forwarding-class network-control scheduler Q4-network-control; } schedulers { Q0-best-effort { transmit-rate percent 20; buffer-size percent 20; drop-profile-map loss-priority low protocol any drop-profile be-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile be-high-drop-profile; priority low; } Q1-data { transmit-rate percent 35; buffer-size percent 30; drop-profile-map loss-priority low protocol any drop-profile data-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile data-high-drop-profile; priority low; } Q2-video { transmit-rate percent 40; buffer-size percent 35; drop-profile-map loss-priority low protocol any drop-profile video-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile video-high-drop-profile; priority low; } Q3-voice { buffer-size percent 10; priority strict-high; } Q4-network-control { transmit-rate percent 5; buffer-size percent 5; priority high; } } drop-profiles { video -high-drop-profile { fill-level 30 drop-probability 30; fill-level 50 drop-probability 50; fill-level 70 drop-probability 60; fill-level 90 drop-probability 100; } video -low-drop-profile { fill-level 40 drop-probability 30; fill-level 60 drop-probability 50; fill-level 80 drop-probability 60; fill-level 100 drop-probability 100; } data-high-drop-profile { fill-level 25 drop-probability 30; fill-level 45 drop-probability 50; fill-level 65 drop-probability 60; fill-level 85 drop-probability 100; } data-low-drop-profile { fill-level 30 drop-probability 30; fill-level 50 drop-probability 50; fill-level 70 drop-probability 60; fill-level 90 drop-probability 100; } be-high-drop-profile { fill-level 20 drop-probability 30; fill-level 40 drop-probability 50; fill-level 60 drop-probability 60; fill-level 80 drop-probability 100; } be-low-drop-profile { fill-level 25 drop-probability 30; fill-level 45 drop-probability 50; fill-level 65 drop-probability 60; fill-level 85 drop-probability 100; } } } Note: Scheduling policy maps configure the forwarding classes that represent packet queues for the physical interfaces that they are bound to. On M-series and T-series platforms, you can configure one queue per interface to have strict-high priority, which works the same as high priority, but provides unlimited transmission bandwidth. Hence, there is no need to define a transmit-rate for a strict-high priority queue. As long as the queue with strict-high priority has traffic to send, it receives precedence over all other queues, except queues with high priority. Queues with strict-high and high priority take turns transmitting packets until the strict-high queue is empty, the high priority queues are empty, or the high priority queues run out of bandwidth credit. Only then can lower priority queues send traffic. If only 4 queues are supported by the interface, map two classes into one queue as shown in the following example: class-of-service { restricted-queues { forwarding-class best-effort queue 0; forwarding-class data-AF13-AF23 queue 0; forwarding-class video-AF33-AF4 queue 1; forwarding-class voice-EF 2; forwarding-class network-control queue 3; } }

Responsibility

System Administrator

Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Finding ID
NET-SRVFRM-003
Rule ID
SV-20061r3_rule
Severity
Cat II
CCE
(None)
Group Title
ACLs must restrict access to server VLANs.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.

Fix Text

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

Check Content

Review the firewall protecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, then review the ACL configured for the VLAN on the L3 switch.

Responsibility

Information Assurance Officer

Default routes must not be directed to the tunnel entry point.

Finding ID
NET-TUNL-012
Rule ID
SV-20504r2_rule
Severity
Cat II
CCE
(None)
Group Title
NET-TUNL-012
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.

Fix Text

The SA must carefully plan and configure or let IGP determine what goes into each tunnel.

Check Content

Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route. Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

Control plane protection is not enabled.

Finding ID
NET0966
Rule ID
SV-21168r2_rule
Severity
Cat II
CCE
(None)
Group Title
Control plane protection is not enabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages. In addition to control plane and management plane traffic that is in the router’s receive path, the RP must also handle other traffic that must be punted to the RP—that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic. Using the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.

Fix Text

Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.

Check Content

There are numerous rate limiters built into both the Packet Forwarding Engine and the RE to manage exception traffic to and from the RE. Traffic destined to the system is prioritized upon receipt based on protocol in the PFE (forwarding plane). Legitimate traffic bound for the RE is throttled and queued based on protocol priority and appropriately scheduled for transmission across the PFE to RE interface. Juniper is unique. For the most part, ICMP processing is processed by the PFE. This is especially helpful for packets with a next-hop of discard. The forwarding board generates the ICMP unreachable, not the routing engine. These mechanisms aren't configurable and have always been part of the Juniper M/T series architecture. In addition, Juniper handles fragmentation in the data plane, not the RE. Step 1: Verify that an inbound filter has been applied to the loopback interface to restrict traffic destined to the router. The interface configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { no-redirects; filter { input router-protect-filter; } address 10.10.2.1/32 } } } } Step 2: Verify the filter bound to the router’s loopback address restricts all control plane and management plane traffic. The filter configuration should look similar to the following: firewall { filter router-protect-filter { /* police management and ICMP traffic */ policer mgmt-128k { if-exceeding { bandwidth-limit 128k; burst-size-limit 2k; } then discard; } policer mgmt-64k { if-exceeding { bandwidth-limit 64k; burst-size-limit 1k; } then discard; } policer icmp-64k { if-exceeding { bandwidth-limit 64k; burst-size-limit 1k; } then discard; } /* drop framgmented ICMP messages */ term fragmented-icmp { from { protocol icmp; is-fragment; } then { syslog; discard; } } /* allow specific management plane traffic */ term ssh-access { from { source-address { 192.168.1.0/24; } protocol tcp; destination-port ssh; } then { policer mgmt-64k; accept; } } term snmp-access { from { source-address { 192.168.1.22/32; 192.168.1.24/32; } protocol udp; destination-port snmp; } then { policer mgmt-128k; accept; } } term tacacs-access { from { source-address { 192.168.1.101/32; } protocol tcp; port tacacs-ds; } then { policer mgmt-64k; accept; } } term ntp-access { from { source-address { 192.168.1.70/32; 192.168.1.77/32; } protocol udp; port ntp; } then { policer mgmt-64k; accept; } } term allow-ICMP { from { source-address { 192.168.1.0/24; } protocol icmp; } then { policer icmp-64k; accept; } } /* allow specific control plane traffic */ term guard-bgp { from { source-address { 199.21.32.11/32; 199.21.32.12/32; } protocol tcp; port bgp; } then { syslog; accept; } } term guard-ospf { from { source-address { 199.21.32.11/32; 199.21.32.12/32; } protocol ospf; } then { syslog; accept; } } … … … term default-action { then { syslog; discard; } } } }

Responsibility

System Administrator

Long Name: The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic.

Finding ID
NET-MCAST-010
Rule ID
SV-21170r1_rule
Severity
Cat III
CCE
(None)
Group Title
No Admin-local or Site-local boundary
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.

Fix Text

Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.

Check Content

The following examples will establish a multicast boundary on the interface to ensure that Local-scope IPv4 traffic or Site-local scope IPv6 traffic is not allowed into or out of the administratively scoped multicast region. You can configure multicast scoping with a scope statement or with a scope-policy statement as shown in the examples. Example using the scope statement routing-options { multicast { scope ipv4-administrative-scope { interface [fe-1/1/1 fe-1/1/2]; prefix 239.255.0.0/16; } scope ipv6-administrative-scope { interface [fe-1/1/1 fe-1/1/2]; prefix FF05::/16; } } } Example using the scope-policy statement routing-options { multicast { scope-policy block-admin-scope; } } . . . policy-options { policy-statement block-admin-scope { term reject-i { from { route-filter 239.255.0.0/16 orlonger; route-filter FF08::/16 orlonger; } then reject; } } }

Responsibility

System Administrator

The network element must use two or more NTP servers to synchronize time.

Finding ID
NET0812
Rule ID
SV-41498r1_rule
Severity
Cat III
CCE
(None)
Group Title
Two NTP servers are not used to synchronize time.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.

Fix Text

Configure the device to use two separate NTP servers.

Check Content

Review the router or switch configurations and verify that two or more NTP servers have been defined similar to the following example: [edit system] ntp { boot-server 129.237.32.2; server 129.237.32.2; server 142.181.31.6; } Note: The boot-server statement identifies the server from which the initial time of day and date is obtained when the router boots. The server statements identify the NTP servers used for periodic time synchronization.

Responsibility

System Administrator

A service or feature that calls home to the vendor must be disabled.

Finding ID
NET0405
Rule ID
SV-36774r5_rule
Severity
Cat II
CCE
(None)
Group Title
Call home service is disabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.

Fix Text

Configure the network device to disable the call home service or feature. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

Check Content

Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

Responsibility

Information Assurance Officer

The network device must log all access control lists (ACL) deny statements.

Finding ID
NET1020
Rule ID
SV-15475r3_rule
Severity
Cat III
CCE
(None)
Group Title
Interface ACL deny statements are not logged.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.

Fix Text

Configure interface ACLs to log all deny statements.

Check Content

Review the network device interface ACLs to verify all deny statements are logged. Either the syslog or log action command will satisfy this requirement. JUNOS Example: [edit firewall] family inet { filter NIPRNet-ingress { term first-accept { from { } then accept; } term last-accept { from { destination-address { 131.77.5.32/32; 131.77.5.61/32; } protocol tcp; destination-port http; } then accept; } term default-action { then { syslog; discard; } } } }

Responsibility

Information Assurance Officer

IA Controls

ECAT-1, ECAT-2, ECSC-1

The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.

Finding ID
NET1800
Rule ID
SV-3008r1_rule
Severity
Cat II
CCE
(None)
Group Title
IPSec VPN is not configured as a tunnel type VPN.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.

Fix Text

Establish the VPN as a tunneled VPN. Terminate the tunneled VPN outside of the firewall. Ensure all host-to-host VPN are established between trusted known hosts.

Check Content

Have the SA display the configuration settings that enable this feature. Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples: In CISCO Router(config)# crypto ipsec transform-set transform-set-name transform1 Router(cfg-crypto-tran)# mode tunnel OR in Junos edit security ipsec security-association sa-name] mode tunnel

Responsibility

Information Assurance Officer

Network devices must be password protected.

Finding ID
NET0230
Rule ID
SV-3012r4_rule
Severity
Cat I
CCE
(None)
Group Title
Network element is not password protected.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.

Fix Text

Configure the network devices so it will require a password to gain administrative access to the device.

Check Content

Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.

Responsibility

Information Assurance Officer

The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.

Finding ID
NET1639
Rule ID
SV-15454r2_rule
Severity
Cat II
CCE
(None)
Group Title
Management connection does not timeout.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.

Fix Text

Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

Check Content

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example: [edit system login] class superuser-local { idle-timeout 10; permissions all; } Note: There is no default idle-timeout; hence, without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class. When ssh is enabled, all users can use it to access the router---including the root account. This presents two problems: 1) The root account now be accessed using in-band management 2) Since the root account does not belong to a login class, there is no way to set the idle timeout. Access to the root account via ssh must be disabled via root-login deny command. Following is an example configuration: [edit system] services { ssh { root-login deny;

Responsibility

Information Assurance Officer

The network element must have DNS servers defined if it is configured as a client resolver.

Finding ID
NET0820
Rule ID
SV-15331r2_rule
Severity
Cat III
CCE
(None)
Group Title
DNS servers must be defined for client resolver.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.

Fix Text

Configure the device to include DNS servers or disable domain lookup.

Check Content

Review the active configuration to ensure that DNS servers have been defined similar to the following example: [edit system] name server { 192.168.1.253; 192.168.1.254; } Note: Since JUNOS will not send a DNS query to resolve names to IP addresses if a name server is not defined, this will never be a finding.

Responsibility

Information Assurance Officer

The network element must only allow write and poll SNMP access by authorized internal IP addresses.

Finding ID
NET0890
Rule ID
SV-15333r2_rule
Severity
Cat II
CCE
(None)
Group Title
SNMP access is not restricted by IP address.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.

Fix Text

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

Check Content

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example: snmp { interface ge-0/1/0.0; community xxxxxxxxx { authorization read-only; clients { default restrict; 7.7.7.5/32; } } } Note: if the clients statement is not present, then all clients are allowed.

Responsibility

Information Assurance Officer

The network element must authenticate all IGP peers.

Finding ID
NET0400
Rule ID
SV-15291r2_rule
Severity
Cat II
CCE
(None)
Group Title
Interior routing protocols are not authenticated.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A rogue router could send a fictitious routing update to convince a site’s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks.

Fix Text

Configure authentication for all IGP peers.

Check Content

Review the device configuration to determine if authentication is configured for all IGP peers. If authentication is not configured for all IGP peers, this is a finding.

Responsibility

Information Assurance Officer

The network device must use different SNMP community names or groups for various levels of read and write access.

Finding ID
NET1675
Rule ID
SV-3043r4_rule
Severity
Cat II
CCE
(None)
Group Title
SNMP privileged and non-privileged access.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.

Fix Text

Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.

Check Content

Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.

Responsibility

Information Assurance Officer

Group accounts must not be configured for use on the network device.

Finding ID
NET0460
Rule ID
SV-3056r7_rule
Severity
Cat I
CCE
(None)
Group Title
Group accounts are defined.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.

Fix Text

Configure individual user accounts for each authorized person then remove any group accounts.

Check Content

Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.

Responsibility

Information Assurance Officer

Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.

Finding ID
NET0465
Rule ID
SV-15472r4_rule
Severity
Cat II
CCE
(None)
Group Title
Accounts assigned least privileges necessary to perform duties.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.

Fix Text

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

Check Content

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding. Below is an example configuration with three levels of authorization followed by account templates. [edit system login] class tier1 { idle-timeout 15; permissions [configure interface network routing snmp system trace view firewall ]; } class tier2 { idle-timeout 15; permissions [admin clear configure interface network reset routing routing-control snmp snmp-control system system-control trace trace-control view maintenance firewall firewall-control secret rollback ]; } class tier3 { idle-timeout 15; permissions all; } /* This is our local superuser account with a local password. */ user admin { full-name Administrator; uid 2000; class tier3; authentication { encrypted-password xxxxxxx; } } /* TACACS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } user tier3 { uid 2003; class tier3; } Using the example JUNOS configuration above and TACACS configuration below, when a user is using a template account, the CLI username is the login name; however, the privileges, file ownership, and effective user ID are inherited from the template account. The CLI username is sent to the authentication server with the correct password. The server returns the local username (i.e., “tier2”) to the JUNOS software as specified in the authentication server (local-user-name for TACACS+, Juniper-Local-User for RADIUS). user = simon { . . . . service = junos-exec { local-user-name = tier2 allow-commands = "configure" deny-commands = "shutdown" } } 'allow-commands' and 'deny-commands' override permissions of the class of the template that the local-user-name is associated with.

Responsibility

Information Assurance Officer

The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.

Finding ID
NET-MCAST-001
Rule ID
SV-40313r1_rule
Severity
Cat II
CCE
(None)
Group Title
PIM enabled on wrong interfaces
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.

Fix Text

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.

Check Content

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM. Review the interfaces that have been defined under the protocols PIM hierarchy and verify that they all need to support multicast routing. When using the explicit interface declarations, the configuration would look similar to the following: protocols { pim { interface so-7/0/1.0 { mode sparse; version 2; } interfaces ge-0/3/0.0 { mode sparse; version 2; } … … … } If the interface all statement is used, verify that interfaces not supporting multicast routing have PIM disabled using the disable keyword. The configuration would look similar to the following: protocols { pim { interface all { mode sparse; version 2; } interface fx0.0 { disable; } interfaces fe-1/1/1 { disable; } interfaces fe-1/1/2 { disable; } } }

Responsibility

System Administrator

The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.

Finding ID
NET-MCAST-002
Rule ID
SV-40316r1_rule
Severity
Cat II
CCE
(None)
Group Title
PIM neighbor filter is not configured
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.

Fix Text

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

Check Content

Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram. JUNOS does not have a PIM neighbor filter; Hence, a firewall filter will have to be used similar to the example shown below. Step 1: Verify that an input filter is configured that will specify the allowable PIM neighbors similar to the following example. firewall { filter input-filter { term pim-neighbors { from { source-address { 192.0.2.1/32; 192.0.2.3/32; } destination-address { 224.0.0.13/32; } protocol pim; } then accept; } term … Step 2: Verify that an input filter is applied to all PIM enabled interfaces. The configuration should look similar to the following: interfaces fe-1/1/1 { unit 0 { family inet { filter { input input-filter; } address 192.0.2.2/32; } } } To determine which interfaces are enabled for PIM, review the interface section within the protocols pim hierarchy that will look similar to the following example: protocols { … pim { interface all { mode sparse; } } }

Responsibility

Information Assurance Officer

Unauthorized accounts must not be configured for access to the network device.

Finding ID
NET0470
Rule ID
SV-3058r5_rule
Severity
Cat II
CCE
(None)
Group Title
Unauthorized accounts are configured to access device.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.

Fix Text

Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.

Check Content

Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.

Responsibility

Information Assurance Officer

The administrator must ensure that the maximum hop limit is at least 32.

Finding ID
NET-IPV6-059
Rule ID
SV-40390r1_rule
Severity
Cat III
CCE
(None)
Group Title
Maximum hop limit is less than 32
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.

Fix Text

Configure maximum hop limit to at least 32.

Check Content

Review the router or multi-layer switch configuration to determine if the default maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. protocols { … … router-advertisement { interface [fe-1/1/1 fe-1/1/2] { current-hop-limit 128; } … } } Note: The JUNOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.

Responsibility

Information Assurance Officer

The network element must be configured to ensure passwords are not viewable when displaying configuration information.

Finding ID
NET0600
Rule ID
SV-41451r2_rule
Severity
Cat I
CCE
(None)
Group Title
Passwords are viewable when displaying the config.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.

Fix Text

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

Check Content

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network.

Finding ID
NET-IPV6-065
Rule ID
SV-40455r1_rule
Severity
Cat II
CCE
(None)
Group Title
The 6-to-4 router is not filtering protocol 41
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.

Fix Text

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.

Check Content

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Responsibility

Information Assurance Officer

Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.

Finding ID
NET1638
Rule ID
SV-15452r4_rule
Severity
Cat II
CCE
(None)
Group Title
Management connections must be secured by FIPS 140-2.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Fix Text

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

Check Content

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS -SSL -TLS JUNOS Example: [edit system services] ssh { root-login (allow | deny | deny-password); protocol-version [ v2 ]; macs [hmac-sha1 hmac-sha1-96]; ciphers [aes128-cbc aes192-cbc aes256-cbc]; } [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } … [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port ssh; } then { syslog; accept; } } … term default-action { then { syslog; discard; } } } } If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

The network element must log all attempts to establish a management connection for administrative access.

Finding ID
NET1640
Rule ID
SV-15456r2_rule
Severity
Cat III
CCE
(None)
Group Title
Management connections must be logged.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.

Fix Text

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

Check Content

Review the router configurations and verify that all ssh connection attempts are logged. The configuration should look similar to the following: [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port [ssh]; } then { syslog; accept; } } term default-action { then { syslog; discard; } } } }

Responsibility

Information Assurance Officer

The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Finding ID
NET-IPV6-066
Rule ID
SV-40541r1_rule
Severity
Cat III
CCE
(None)
Group Title
6-to-4 router not filtering invalid source address
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router.

Fix Text

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Check Content

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Responsibility

Information Assurance Officer

The administrator must ensure the that all L2TPv3 sessions are authenticated prior to transporting traffic.

Finding ID
NET-TUNL-034
Rule ID
SV-40557r1_rule
Severity
Cat II
CCE
(None)
Group Title
L2TPv3 sessions are not authenticated
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.

Fix Text

Configure L2TPv3 to use authentication for any peering sessions.

Check Content

Currently JUNOS does not support L2TPv3 so this vulnerability is not applicable.

Responsibility

Information Assurance Officer

The network element must have the Finger service disabled.

Finding ID
NET0730
Rule ID
SV-15306r2_rule
Severity
Cat III
CCE
(None)
Group Title
The finger service is not disabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.

Fix Text

Configure the device to disable the Finger service.

Check Content

Under the edit system services hierarchy, enter a show command to verify that the finger command is not present.

Responsibility

Information Assurance Officer

The router must have IP source routing disabled.

Finding ID
NET0770
Rule ID
SV-15317r2_rule
Severity
Cat II
CCE
(None)
Group Title
IP Source Routing is not disabled on all routers.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.

Fix Text

Configure the router to disable IP source routing.

Check Content

Under the edit chassis hierarchy, enter a show command to verify that the no-source-route command is present.

Responsibility

Information Assurance Officer

The network element must have HTTP service for administrative access disabled.

Finding ID
NET0740
Rule ID
SV-41468r2_rule
Severity
Cat II
CCE
(None)
Group Title
HTTP server is not disabled
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.

Fix Text

Configure the device to disable using HTTP (port 80) for administrative access.

Check Content

Under the edit system services hierarchy enter a show command to verify the web-management http command is not present (the web-management https command may be enabled for administrative access). If you are reviewing an entire configuration, verify the web-management http command is not present as shown in the example below: system { services { web-management { http { interface ge-0/0/0.0; } } } } If the HTTP server is enabled, this is a finding.

The network element must authenticate all BGP peers within the same or between autonomous systems (AS).

Finding ID
NET0408
Rule ID
SV-41556r2_rule
Severity
Cat II
CCE
(None)
Group Title
BGP must authenticate all peers.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet—including RST flags. One way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.

Fix Text

Configure the device to authenticate all BGP peers.

Check Content

Review the router configuration to determine if authentication is being used for all peers. An authentication key should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example: protocols bgp { group external-peers { type external; neighbor 171.69.232.90 { peer-as 200; authentication-key xxxxx; } neighbor 171.69.232.100 { peer-as 300; authentication-key xxxxx; } } } Note: The authentication-key statement can be applied at the BGP level, at the group level, or at the neighbor level.

Network devices must not have any default manufacturer passwords.

Finding ID
NET0240
Rule ID
SV-3143r4_rule
Severity
Cat I
CCE
(None)
Group Title
Devices exist with standard default passwords.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.

Fix Text

Remove any vendor default passwords from the network devices configuration.

Check Content

Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.

Responsibility

Information Assurance Officer

The network element must be running a current and supported operating system with all IAVMs addressed.

Finding ID
NET0700
Rule ID
SV-15303r2_rule
Severity
Cat II
CCE
(None)
Group Title
Operating system is not at a current release level.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.

Fix Text

Update operating system to a supported version that addresses all related IAVMs.

Check Content

In operational mode, have the router administrator execute the show version brief command to verify the installed JUNOS version. This command will show the base OS as well as the kernel, packet forwarding engine, routing, and crypto. Validate that all software components are at the required level. J, M and T series should be 10.0 or later. E series should be 10.2 or later Verify that all IAVMs have been addressed.

Responsibility

Information Assurance Officer

The network device must require authentication prior to establishing a management connection for administrative access.

Finding ID
NET1636
Rule ID
SV-28748r3_rule
Severity
Cat I
CCE
(None)
Group Title
Management connections must require passwords.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.

Fix Text

Configure authentication for all management connections.

Check Content

Review the network device configuration to verify all management connections for administrative access require authentication. With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. Following is an example: [edit system] authentication-order [ radius password ]; radius-server { 192.168.6.5 { secret "xxxxxxx"; } } login { /* login classes */ class tier1 { idle-timeout 10; permissions all; } class tier2 { idle-timeout 10; permissions [ configure interface network routing snmp system trace view firewall ]; } /* local emgergency account */ user admin { full-name Administrator; uid 2000; class tier1; authentication { encrypted-password "xxxx"; # SECRET-DATA } } /* RADIUS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } } Note: When SSH is enabled, all users can use this service to access the router---including the root account. Access to the root account via SSH must be disabled via root-login deny command. Following is an example configuration: [edit system] services { ssh { root-login deny;

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.

Finding ID
NET1660
Rule ID
SV-3196r4_rule
Severity
Cat I
CCE
(None)
Group Title
An insecure version of SNMP is being used.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.

Fix Text

If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).

Check Content

Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.

Responsibility

Information Assurance Officer

The network device must not use the default or well-known SNMP community strings public and private.

Finding ID
NET1665
Rule ID
SV-3210r4_rule
Severity
Cat I
CCE
(None)
Group Title
Using default SNMP community names.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".

Fix Text

Configure unique SNMP community strings replacing the default community strings.

Check Content

Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.

Responsibility

Information Assurance Officer

In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.

Finding ID
NET0440
Rule ID
SV-30085r5_rule
Severity
Cat II
CCE
(None)
Group Title
More than one local account is defined.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.

Fix Text

Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.

Check Content

Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency. Example: [edit system] class tier3 { idle-timeout 15; permissions all; } user admin { full-name Administrator; uid 2000; class tier3; authentication { encrypted-password xxxxxxxxxxx; } } Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.

The network element must time out access to the console port after 10 minutes or less of inactivity.

Finding ID
NET1624
Rule ID
SV-15445r2_rule
Severity
Cat II
CCE
(None)
Group Title
The console port does not timeout after 10 minutes.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.

Fix Text

Configure the timeout for idle console connection to 10 minutes or less.

Check Content

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example: [edit system login] class superuser-local { idle-timeout 10; permissions all; } Notes: 1. There is no default idle-timeout. Without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class. 2. Since the root account does not belong to a class and you can access root via console, disable the ability to login using the root account by making the console insecure as follows: [edit system] console { insecure; }

Responsibility

Information Assurance Officer

The network device must only allow SNMP read-only access.

Finding ID
NET0894
Rule ID
SV-30087r3_rule
Severity
Cat II
CCE
(None)
Group Title
Network element must only allow SNMP read access.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.

Fix Text

Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.

Check Content

Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding. The SNMP V1 configuration should look similar to the following: snmp { interface ge-0/1/0.0; community xxxxxxxxx { authorization read-only; clients { default restrict; 7.7.7.5/30; } } SNMPv3 access sets the SNMP access levels by context, group, and user. The context-name statement determines what management information is accessible by an SNMP entity. An SNMP entity can have access to many access contexts and therefore requires a name to identify each context. You must also associate a context with a specific access group and configure read and write views associated with each group. Specify the group-name variable to identify a collection of SNMP users that share the same access policy, in which object identifiers (OIDs) are read-accessible or write-accessible. Each group is the collection of users associated with the security model. You can only specify the model usm. The example below as a “router context” which is accessed by two groups: NOC and engineers. NOC is only allowed read access while engineers have read and write access. John and Sue are users that belong to the engineers group and have authentication configured. snmp { view all { oid .1.3.6.1 include; } engine-id { local "isp-routers-0001"; } access { user john { authentication-type md5; authentication-password "john-auth-password"; privacy-type des; privacy-password "john-privacy-password"; } user sue { authentication-type md5; authentication-password "sue-auth-password"; privacy-type des; privacy-password "sue-privacy-password"; } user hpov { authentication-type md5; authentication-password "hpov-auth-password"; privacy-type des; privacy-password "hpov-privacy-password"; } group engineers { model usm; user [john sue]; } group noc { model usm; user hpov; } context router { description “a router context”; group noc { model usm; security-level privacy; read-view all; } group engineers { model usm; security-level privacy; read-view all; write-view all; } } }

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The network device must require authentication for console access.

Finding ID
NET1623
Rule ID
SV-28747r3_rule
Severity
Cat I
CCE
(None)
Group Title
Authentication required for console access.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.

Fix Text

Configure authentication for console access on the network device.

Check Content

Review the network device's configuration and verify authentication is required for console access. With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class as shown in the following example: [edit system] authentication-order [ radius password ]; radius-server { 192.168.6.5 { secret "xxxxxxx"; } } login { /* login classes */ class tier1 { idle-timeout 10; permissions all; } class tier2 { idle-timeout 10; permissions [ configure interface network routing snmp system trace view firewall ]; } /* local emgergency account */ user admin { full-name Administrator; uid 2000; class tier1; authentication { encrypted-password "xxxx"; # SECRET-DATA } } /* RADIUS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } } Note: Since the root account does not belong to a class and you can access root via console, disable the ability to login at the console using the root account by making the console insecure as follows: [edit system] console { insecure; }

Responsibility

Information Assurance Officer

IA Controls

IAIA-1, IAIA-2

The router administrator will ensure a password is required to gain access to the router's diagnostics port.

Finding ID
NET0580
Rule ID
SV-4583r1_rule
Severity
Cat III
CCE
(None)
Group Title
Password required on the JUNOS diagnostic port.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

If unauthorized users gain access to the routers diagnostic port, it is possible to disrupt service.

Fix Text

The router administrator will ensure that a password is required to access the routers diagnostic port.

Check Content

IOS Procedure: N/A A Cisco router does not have a diagnostics port. JUNOS Procedure: Review the router configuration to ensure a password is required when gaining access to the diagnostics port similar to the following: [edit system] diag-port-authentication { encrypted-password "xxxxxxxxxxxxx"; # SECRET-DATA }

Responsibility

Information Assurance Officer

The network element must log all messages except debugging and send all log data to a syslog server.

Finding ID
NET1021
Rule ID
SV-15477r2_rule
Severity
Cat III
CCE
(None)
Group Title
The network element must log all messages except debugging.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.

Fix Text

Configure the network device to log all messages except debugging and send all log data to a syslog server.

Check Content

Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example: [edit system syslog] syslog { host 192.168.1.22 { any info; facility-override local7; } } The table below lists the severity levels and message types for all log data. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging

Responsibility

Information Assurance Officer

The network element must only allow management connections for administrative access from hosts residing in to the management network.

Finding ID
NET1637
Rule ID
SV-15450r3_rule
Severity
Cat II
CCE
(None)
Group Title
Management connections are not restricted.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Fix Text

Configure an ACL or filter to restrict management access to the device from only the management network.

Check Content

Review the router configuration and verify that only authorized internal connections are allowed access to the routing engine via ssh. Access to the Juniper routing engine is via loopback interface. The configuration should look similar to the following: [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port ssh; } then { syslog; accept; } } term default-action { then { log; discard; } } } }

The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.

Finding ID
NET1645
Rule ID
SV-28744r2_rule
Severity
Cat II
CCE
(None)
Group Title
SSH session timeout is not 60 seconds or less.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.

Fix Text

Configure the network devices so it will require a secure shell timeout of 60 seconds or less.

Check Content

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period. system { login { retry-options { tries-before-disconnect 3; maximum-time 60; }

Responsibility

Information Assurance Officer

The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.

Finding ID
NET1646
Rule ID
SV-28745r2_rule
Severity
Cat II
CCE
(None)
Group Title
SSH login attempts value is greater than 3.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.

Fix Text

Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.

Check Content

Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3. system { login { retry-options { tries-before-disconnect 3; maximum-time 60; }

Responsibility

Information Assurance Officer

The network device must drop half-open TCP connections through filtering thresholds or timeout periods.

Finding ID
NET0965
Rule ID
SV-15437r4_rule
Severity
Cat II
CCE
(None)
Group Title
Devices not configured to filter and drop half-open connections.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An attacker’s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.

Fix Text

Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.

Check Content

Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections. For timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering. JUNOS Configuration Example: firewall { policer TCP-SYN-Policer { if-exceeding { bandwidth-limit 500k; burst-size-limit 15k; } then discard; } family inet { filter DOS-Protect { . . . /* Term tcp-syn-fin-limit: Rate limit TCP packets with SYN/FIN/RST flags. */ term tcp-syn-fin-limit { from { protocol tcp; port [bgp ldp snmp snmptrap telnet ftp ftp-data ssh]; tcp-flags “syn | fin | rst”; } then policer TCP-SYN-Policer; } . . }

Responsibility

Information Assurance Officer

IA Controls

ECSC-1

The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.

Finding ID
NET1629
Rule ID
SV-15447r2_rule
Severity
Cat III
CCE
(None)
Group Title
The auxiliary port is not disabled.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.

Fix Text

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

Check Content

Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.If the following configuration statements are found than a secure modem should be in place. [edit system] ports { auxiliary { type vt100; } }

Responsibility

Information Assurance Officer