Detections
Analytics
JUEX-RT-000720 - The Juniper BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Information
GTSM is designed to protect a router's IP-based control plane from DoS attacks. Many attacks focused on CPU load and line-card overload can be prevented by implementing GTSM on all Exterior Border Gateway Protocol speaking routers.GTSM is based on the fact that the vast majority of control plane peering is established between adjacent routers; that is, the Exterior Border Gateway Protocol peers are either between connecting interfaces or between loopback interfaces. Since TTL spoofing is considered nearly impossible, a mechanism based on an expected TTL value provides a simple and reasonably robust defense from infrastructure attacks based on forged control plane traffic.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure all Exterior Border Gateway Protocol peering sessions to use GTSM.set firewall family inet filter gtsm term 1 from protocol tcp
set firewall family inet filter gtsm term 1 from ttl 255
set firewall family inet filter gtsm term 1 from destination-port bgp
set firewall family inet filter gtsm term 1 then accept
set firewall family inet filter gtsm term 2 from protocol tcp
set firewall family inet filter gtsm term 2 from destination-port bgp
set firewall family inet filter gtsm term 2 then log
set firewall family inet filter gtsm term 2 then syslog
set firewall family inet filter gtsm term 2 then discard
<additional accept terms>
set firewall family inet filter gtsm term default then log
set firewall family inet filter gtsm term default then syslog
set firewall family inet filter gtsm term default then discard
For those platforms that support 'ttl-except':
set firewall family inet filter gtsm term 1 from protocol tcp
set firewall family inet filter gtsm term 1 from ttl-except 255
set firewall family inet filter gtsm term 1 from destination-port bgp
set firewall family inet filter gtsm term 1 then log
set firewall family inet filter gtsm term 1 then syslog
set firewall family inet filter gtsm term 1 then discard
<additional accept terms>
set firewall family inet filter gtsm term default then log
set firewall family inet filter gtsm term default then syslog
set firewall family inet filter gtsm term default then discard
set interfaces <BGP interface> unit <number> family inet filter input gtsm
set interfaces <BGP interface> unit <number> family inet address <IPv4 address>.<mask>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Router v2r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-5, CAT|III, CCI|CCI-002385, CCI|CCI-004866, Rule-ID|SV-254044r997536_rule, STIG-ID|JUEX-RT-000720, Vuln-ID|V-254044
Plugin: Juniper
Control ID: e8e151ff0f5888784ab1fb7adfd7447b9164cc9711bd5ce8b97ca0c3dc31b403