JUEX-RT-000540 - The Juniper BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

Information

If the same keys are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It is possible that a malicious user exists in one autonomous system who would know the key used for the eBGP session. This user would then be able to hijack BGP sessions with other trusted neighbors.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure all eBGP routers with unique keys for each eBGP neighbor that it peers with.

set security ipsec security-association <sa name> manual direction bidirectional protocol esp
set security ipsec security-association <sa name> manual direction bidirectional spi <SPI value>
set security ipsec security-association <sa name> manual direction bidirectional authentication algorithm hmac-sha-256-128
set security ipsec security-association <sa name> manual direction bidirectional authentication key ascii-text <PSK value>

set protocols bgp group <group name> type external
set protocols bgp group <group name> local-as <local AS number>
set protocols bgp group <group name> neighbor <neighbor 1 address> authentication-key <PSK value>
set protocols bgp group <group name> neighbor <neighbor 2 address> ipsec-sa test

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT

References: 800-53|AC-4(17), 800-53|CM-6b., CAT|II, CCI|CCI-000366, CCI|CCI-002205, Rule-ID|SV-254026r945862_rule, STIG-ID|JUEX-RT-000540, Vuln-ID|V-254026

Plugin: Juniper

Control ID: 25577b1ac7e510d5d2cd668a5ea014d0ee20fb6d8c97cbf813701a3a5882e1f9