Detections
Analytics

CISC-RT-000040 - The Cisco router must be configured to use encryption for routing protocol authentication - OSPF

Information

A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network or used to disrupt the network's ability to communicate with other networks. This is known as a 'traffic attraction attack' and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack.

This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and multicast-related protocols.

Solution

Configure the key chains used by the routing protocols to have the keys encrypted as shown in the example below. OSPF and BGP example shown, but others are configured similarly.

RP/0/0/CPU0:R2(config)#key chain OSPF_KEY_CHAIN
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN)#key 1
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-1)#accept-lifetime 01:00:00 jan 01 2019 01:00:00 april 01 2019
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-1)#key-string password xxxxxxxxxxxxxxx
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-1)#send-lifetime 01:00:00 jan 01 2019 01:00:00 april 01 2019
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-1)#cryptographic-algorithm HMAC-SHA1-96
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-1)#key 2
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-2)#accept-lifetime 01:00:00 april 01 2019 01:00:00 july 01 2019
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-2)#key-string password xxxxxxxxxxxxxxx
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-2)#send-lifetime 01:00:00 april 01 2019 01:00:00 july 01 2019
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-2)#cryptographic-algorithm HMAC-SHA1-96
RP/0/0/CPU0:R2(config-OSPF_KEY_CHAIN-2)#end

Configure BGP to use TCP-AO to replace MD5.

Configure Keychain for BGP
RP/0/0/CPU0:R2(config)#key chain BGP_KEY_CHAIN
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN)# key 1
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN-1)#accept-lifetime 00:00:00 january 01 2022 infinite
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN-1)#key-string password xxxxxxxxxxx
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN-1)#send-lifetime 00:00:00 january 01 2022 infinite
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN-1)#cryptographic-algorithm HMAC-SHA-256
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN-1)#exit
RP/0/RP0/CPU0:R2(config-BGP_KEY_CHAIN)#exit

Configure TCP AO
RP/0/0/CPU0:R2(config)#tcp ao
RP/0/0/CPU0:R2(config-tcp-ao)#keychain BGP_KEY_CHAIN
RP/0/0/CPU0:R2(config-tcp-ao-BGP_KEY_CHAIN)#key <KEY-ID> SendID <ID> ReceiveID <ID>
RP/0/0/CPU0:R2(config-tcp-ao-BGP_KEY_CHAIN)#exit
RP/0/0/CPU0:R2(config-tcp-ao)#exit

Configure BGP Neighbor to use TCP AO
RP/0/RP0/CPU0:R2(config)#router bgp <ASN>
RP/0/RP0/CPU0:R2(config-bgp)#neighbor X.X.X.X
RP/0/RP0/CPU0:R2(config-bgp-nbr)#remote-as <ASN>
RP/0/RP0/CPU0:R2(config-bgp-nbr)#ao BGP_KEY_CHAIN
RP/0/RP0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicast
RP/0/RP0/CPU0:R2(config-bgp-nbr)#exit
RP/0/RP0/CPU0:R2(config-bgp)#exit
RP/0/RP0/CPU0:R2(config)#commit

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS-XR_Router_Y23M06_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000803, Rule-ID|SV-216738r894621_rule, STIG-ID|CISC-RT-000040, STIG-Legacy|SV-105821, STIG-Legacy|V-96683, Vuln-ID|V-216738

Plugin: Cisco

Control ID: 70660705110357f84a90d177e4ff519f8638ec9342796fa6484c6a0cea233349