Detections
Analytics

4.1.2 Ensure peer authentication is set to IPSEC SA

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

BGP Neighbors should be strongly authenticated.

 Rationale:
 Where it is deployed, BGP routing is vital for normal operation of an organization's network infrastructure. Correct route information is required for routers to correctly direct traffic through the network.
 An attacker posing as one of the target routers BGP neighbors may inject incorrect information into the route table resulting in DoS attack or loss of confidential data through a Man in the Middle attack. As well as MD5 hash based authentication, JUNOS routers can also authenticate BGP neighbors using IPSEC Security Associations. This allows more robust authentication mechanisms to be used and is recommended as an alternative to MD5 HMAC in high security environments.
 Although M, T and MX series devices normally require a Services PIC or DPC installed to use IPSEC tunnels, no additional hardware is required for IPSEC SA based authentication of BGP neighbors. As with MD5 HMAC, IPSEC SA based Authentication can be configured Globally, at the Group Level or at the Neighbor Level, with more specific settings overriding less specific settings.
 Because IPSEC SA Authentication is intended for use in high security environments, it is recommended that different parameters are configured for each neighbor, particularly where eBGP is used.

 NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To setup IPSEC SA based authentication, first configure a Security Association at the [edit security ipsec] hierarchy;

 [edit security ipsec]
 edit security-association <SA name>
 set description <description>
 set mode transport
 set manual direction bidirectional protocol ah
 set manual direction bidirectional authentication algorithm <authentication method>
 set manual direction bidirectional authentication key <key>
 The SA must be bi-directional and must be configured with the same parameters on all neighbors reachable on the intended interface. Note that only Authenticated Header is configured in this example which provides mutual authentication but does not encrypt BGP protocol messages in transit.
 To configure IPSEC SA based authentication globally for BGP, issue the following command from the [edit protocols bgp] hierarchy;

 [edit protocols bgp]
 user@host#set ipsec-sa
 To configure IPSEC SA based authentication for a group, issue the following command from the [edit protocols bgp group <group name>] hierarchy;

 [edit protocols bgp group <group name>]
 user@host#set ipsec-sa <SA name>
 To configure IPSEC SA based authentication for a neighbor, issue the following command from the [edit protocols bgp group <group name> neighbor <neighbor ip address>] hierarchy;

 [edit protocols bgp group <group name> neighbor <neighbor ip address>]
 user@host#set ipsec-sa <SA name>

 Default Value:
 No BGP routing is configured by default.

See Also

https://workbench.cisecurity.org/files/2278

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3, CSCv7|16.4

Plugin: Juniper

Control ID: 2ba3b14edd7ca90436656aef2dde07e23736f8aea7727726aacf8a58caabdab7