NET0412 - Unique keys are not used for eBGP authentication

Information

If multiple eBGP peers are defined in the network, the IAO will ensure all eBGP neighbor authentications are configured with unique passwords when TCP MD5 Signature option is implemented.

If the same keys are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It is possible that a malicious user exists in one autonomous system who would know the key used for the eBGP session. This user would then be able to hijack BGP sessions with other trusted neighbors.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure all eBGP routers with unique keys for each eBGP neighbor that it peers with.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

References: CAT|II, Rule-ID|SV-15300r2_rule, STIG-ID|NET0412, Vuln-ID|V-14666

Plugin: Cisco

Control ID: 8ae8c5f6d70bd13ba627c402bbd70e0f2d12d1c98f3805ec19fdc3ae9f2c7359