Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

HP FlexFabric Switch RTR Security Technical Implementation Guide

  • Version/Release: V1R2
  • Published: 2020-06-03
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.
b
The HP FlexFabric Switch must be configured so inactive HP FlexFabric Switch interfaces are disabled.
AC-4 - Medium - CCI-001414 - V-65965 - SV-80455r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000001
Vuln IDs
  • V-65965
Rule IDs
  • SV-80455r1_rule
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use.
Checks: C-66613r1_chk

Review the network topology diagram and determine which HP FlexFabric Switch interfaces should be inactive. If there are inactive HP FlexFabric Switch interfaces that are enabled, this is a finding. [HP]display current-configuration interface interface GigabitEthernet0/1 port link-mode route pim sm ip address 192.168.10.1 255.255.255.0 packet-filter 3010 inbound

Fix: F-72041r1_fix

Disable inactive the HP FlexFabric Switch interface: [HP-GigabitEthernet0/1] shutdown

b
The HP FlexFabric Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.
AC-4 - Medium - CCI-001414 - V-66099 - SV-80589r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000002
Vuln IDs
  • V-66099
Rule IDs
  • SV-80589r1_rule
If the static routes to the alternate gateway are being redistributed into an Exterior Gateway Protocol or Interior Gateway Protocol to a NIPRNet gateway, this could make traffic on NIPRNet flow to that particular router and not to the Internet Access Point routers. This could not only wreak havoc with traffic flows on NIPRNet, but it could overwhelm the connection from the router to the NIPRNet gateway(s) and also cause traffic destined for outside of NIPRNet to bypass the defenses of the Internet Access Points.
Checks: C-66745r1_chk

Review the External/internal gateway protocol database on the HP FlexFabric Switch to ensure no static routes are being redistributed via these protocols. If there are static routes being re-distributed, this is a finding. [HP] display ospf lsdb OSPF Process 1 with HP FlexFabric Switch ID 5.9.2.0 Link State Database Area: 0.0.0.1 Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric HP FlexFabric Switch 1.1.1.1 1.1.1.1 1644 48 80000155 0 HP FlexFabric Switch 5.9.2.0 5.9.2.0 233 48 8000013E 0 HP FlexFabric Switch 2.2.2.2 2.2.2.2 294 72 8000014F 0 AS External Database Type LinkState ID AdvHP FlexFabric Switch Age Len Sequence Metric External 16.0.0.0 5.9.2.0 233 36 80000001 1 External 15.252.0.0 5.9.2.0 233 36 80000001 1 Note: In the example above we see two external entries with the advertising HP FlexFabric Switch as the HP FlexFabric Switch. This exists when the HP FlexFabric Switch is configured to redistribute static route.

Fix: F-72175r1_fix

By default the HP FlexFabric switches do not redistribute static routes via External/Internak gateway protocols. If Static routes redistribution has been configure, use the command bellow to disable it. [HP] ospf 1 [HP-ospf-1] undo import-route static

c
The HP FlexFabric Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.
AC-4 - High - CCI-001414 - V-66101 - SV-80591r1_rule
RMF Control
AC-4
Severity
High
CCI
CCI-001414
Version
HFFS-RT-000003
Vuln IDs
  • V-66101
Rule IDs
  • SV-80591r1_rule
Enclaves with Alternate Gateway (AG) connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's AG, the perimeter router could be routing transit data from the Internet into the NIPRNet. This could also make the perimeter router vulnerable to a DoS attack as well as provide a backdoor into the NIPRNet. The DoD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an AG is secure through filters permitting packets with a destination address belonging to the DoD enclave's address block.
Checks: C-66747r1_chk

Review the configuration of each HP FlexFabric Switch interface connecting to an Alternate Gateway. Verify that the ACL configured to block unauthorized networks are configured on the interface. Verify each permit statement of the ingress filter only permits packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the Alternate Gateway network service provider. If the ACL is not configured to only permit packets with destination addresses within the sites address space, this is a finding. [HP]display interface gig0/1 interface GigabitEthernet0/1 port link-mode route ip address 192.168.10.1 255.255.255.0 packet-filter 3010 inbound

Fix: F-72177r1_fix

Configure the ingress filter of the perimeter HP FlexFabric Switch connected to an Alternate Gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the Alternate Gateway network service provider. [HP] acl advanced 3010 [HP-acl-ipv4-adv-3010] rule 1 permit ip destination 192.168.1.0 0.0.0.255 [HP-acl-ipv4-adv-3010] rule 2 permit ip destination 192.168.2.0 0.0.0.255 [HP-acl-ipv4-adv-3010] rule 3 permit ip destination 192.168.3.0 0.0.0.255 [HP-acl-ipv4-adv-3010] rule 4 permit ip destination 192.168.4.0 0.0.0.255 [HP-acl-ipv4-adv-3010] rule 5 deny ip destination any [HP] interface gig0/1 [HP-GigabitEthernet0/1] packet-filter 3010 inbound

b
If Border Gateway Protocol (BGP) is enabled on the HP FlexFabric Switch, the HP FlexFabric Switch must not be a BGP peer with a HP FlexFabric Switch from an Autonomous System belonging to any Alternate Gateway (AG).
AC-4 - Medium - CCI-001414 - V-66103 - SV-80593r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000004
Vuln IDs
  • V-66103
Rule IDs
  • SV-80593r1_rule
The perimeter router will not use a routing protocol to advertise NIPRNet addresses to Alternate Gateways. Most ISPs use Border Gateway Protocol (BGP) to share route information with other autonomous systems, that is, any network under a different administrative control and policy than a local site. If BGP is configured on the perimeter router, no BGP neighbors will be defined to peer routers from an AS belonging to any Alternate Gateway. The only allowable method is a static route to reach the Alternate Gateway.
Checks: C-66749r1_chk

Review the configuration of the HP FlexFabric Switch connecting to the AG. Verify there are no BGP neighbors configured to the remote AS that belongs to the AG service provider. There should be no BGP peers displayed. If there are BGP neighbors configured that belong to the AG service provider, this is a finding. [HP] display bgp peer ipv4 BGP local FlexFabric Switch ID: 2.2.2.0 Local AS number: 1472 Total number of peers: 1 Peers in established state: 0 * - Dynamically created peer Peer AS MsgRcvd MsgSent OutQ PrefRcv Up/Down State

Fix: F-72179r1_fix

Configure a static route on the perimeter HP FlexFabric Switch to reach the AS of a HP FlexFabric Switch connecting to an Alternate Gateway. [HP] ip route-static 11.11.11.0 16 12.12.12.2

b
The HP FlexFabric Switch must be configured to disable non-essential capabilities.
CM-7 - Medium - CCI-000381 - V-66107 - SV-80597r1_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
HFFS-RT-000006
Vuln IDs
  • V-66107
Rule IDs
  • SV-80597r1_rule
A compromised router introduces risk to the entire network infrastructure as well as data resources that are accessible via the network. The perimeter defense has no oversight or control of attacks by malicious users within the network. Preventing network breaches from within is dependent on implementing a comprehensive defense-in-depth strategy including securing each device connected to the network. This is accomplished by following and implementing all security guidance applicable for each node type. A fundamental step in securing each router is to enable only the capabilities required for operation.
Checks: C-66753r1_chk

Review the configuration to verify that non-essential services are not enabled, if these services are enabled, this is a finding: [HP] display ftp-server FTP is not configured. [HP] display current-configuration | include telnet Note: When Telnet server is enabled, the output for this command is telnet server enable.

Fix: F-72183r1_fix

Disable unsecure protocols and services on the HP FlexFabric Switch: [HP] undo ftp server enable [HP] undo telnet server enable Note: By default, both FTP and Telnet services are disabled.

b
The HP FlexFabric Switch must enable neighbor authentication for all control plane protocols.
CM-6 - Medium - CCI-000366 - V-66109 - SV-80599r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
HFFS-RT-000010
Vuln IDs
  • V-66109
Rule IDs
  • SV-80599r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-66755r1_chk

Review the HP FlexFabric Switch configuration; for every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify that neighbor HP FlexFabric Switch authentication is enabled. If neighbor authentication for all router control plane protocols is not configured, this is a finding. The information below shows OSPF and OSPFv3 authentication is enabled on interface gigabit ethernet 0/0 [HP] display current-configuration interface GigabitEthernet 0/0 # interface GigabitEthernet0/0 port link-mode route description R1 ACTIVE combo enable copper ip address 201.6.1.62 255.255.255.252 ospf authentication-mode md5 1 cipher ********** ospfv3 200 area 0.0.0.0 ospfv3 ipsec-profile jitc ipv6 address 2115:B:1::3E/126

Fix: F-72185r1_fix

The following example shows how to configure the network device to authenticate OSPF and OSPFv3 packets with its peers. OSPF configuration: [HP] ospf 200 [HP-ospf-200] area 0.0.0.0 [HP-ospf-200-area-0.0.0.0] authentication-mode md5 1 cipher ************* [HP-ospf-200-area-0.0.0.0] network 201.6.1.60 0.0.0.3 OSPFv3 Configuration [HP] ospfv3 200 [HP-ospf-200] area 0.0.0.0 IPsec profile configuration for OSPFv3 [HP] ipsec profile jitc manual [HP--ipsec-profile-manual-jitc] transform-set jitcipsecprop [HP--ipsec-profile-manual-jitc] sa spi inbound esp 256 [HP--ipsec-profile-manual-jitc] sa string-key inbound esp simple 2!HPAdmin123123 [HP--ipsec-profile-manual-jitc] sa spi outbound esp 256 [HP--ipsec-profile-manual-jitc] sa string-key outbound esp simple 2!HPAdmin123123 Interface configuration interface GigabitEthernet0/0 port link-mode route description R1 ACTIVE combo enable copper ip address 201.6.1.62 255.255.255.252 ospf authentication-mode md5 1 cipher $c$3$6v1tbSQA2aWAzrgzm36LZrBbmS+jUeg= ospfv3 200 area 0.0.0.0 ospfv3 ipsec-profile jitc ipv6 address 2115:B:1::3E/126

b
The HP FlexFabric Switch must encrypt all methods of configured authentication for routing protocols.
IA-7 - Medium - CCI-000803 - V-66111 - SV-80601r1_rule
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
HFFS-RT-000011
Vuln IDs
  • V-66111
Rule IDs
  • SV-80601r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-66757r1_chk

Verify the HP FlexFabric Switch configuration to ensure that it is using a NIST validated FIPS 140-2 cryptography encryption mechanism by implementing OSPFv3 with IPsec. [HP] display current-configuration interface interface GigabitEthernet0/0 port link-mode route description R1 ACTIVE combo enable copper ospfv3 200 area 0.0.0.0 ospfv3 ipsec-profile jitc ipv6 address 2115:B:1::3E/126 If the routing protocol authentication mechanism is not a validated FIPS 140-2 cryptography, this is a finding. Note: OSPFv3 requires IPsec to enable authentication using either the IPv6 Authentication Header (AH) or the Encapsulating Security Payload (ESP) header.

Fix: F-72187r1_fix

Configure the HP FlexFabric Switch to authenticate OSPFv3 packets: [HP]ipsec transform-set jitcipsecprop [HP-ipsec-transform-set-jitcipsecprop] [HP-ipsec-transform-set-jitcipsecprop] ipsec transform-set jitcipsecprop [HP-ipsec-transform-set-jitcipsecprop] encapsulation-mode transport [HP-ipsec-transform-set-jitcipsecprop] esp encryption-algorithm aes-cbc-256 [HP-ipsec-transform-set-jitcipsecprop] esp authentication-algorithm sha1 [HP-ipsec-transform-set-jitcipsecprop] quit [HP] ipsec profile jitc manual [HP-ipsec-profile-manual-jitc] [HP-ipsec-profile-manual-jitc] ipsec profile jitc manual [HP-ipsec-profile-manual-jitc] transform-set jitcipsecprop [HP-ipsec-profile-manual-jitc] sa spi inbound esp 256 [HP-ipsec-profile-manual-jitc] sa string-key inbound esp simple test123 [HP-ipsec-profile-manual-jitc] sa spi outbound esp 256 [HP-ipsec-profile-manual-jitc] sa string-key outbound esp simple test123 [HP-ipsec-profile-manual-jitc] quit [HP] interface gigabitethernet 0/1 [HP--GigabitEthernet0/1] ospfv3 ipsec-profile jitc

b
The HP FlexFabric Switch must use NIST-validated FIPS 140-2 cryptography to implement authentication encryption mechanisms for routing protocols.
IA-7 - Medium - CCI-000803 - V-66113 - SV-80603r1_rule
RMF Control
IA-7
Severity
Medium
CCI
CCI-000803
Version
HFFS-RT-000012
Vuln IDs
  • V-66113
Rule IDs
  • SV-80603r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack. Since MD5 is vulnerable to "birthday" attacks and may be compromised, routing protocol authentication must use FIPS 140-2 validated algorithms and modules to encrypt the authentication key. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-66759r1_chk

Verify the HP FlexFabric Switch configuration to ensure that it is using a NIST validated FIPS 140-2 cryptography encryption mechanism by implementing OSPFv3 with IPsec. [HP] display current-configuration interface interface GigabitEthernet0/0 port link-mode route description R1 ACTIVE combo enable copper ospfv3 200 area 0.0.0.0 ospfv3 ipsec-profile jitc ipv6 address 2115:B:1::3E/126 If the routing protocol authentication mechanism is not a validated FIPS 140-2 cryptography, this is a finding. Note: OSPFv3 requires IPsec to enable authentication using either the IPv6 Authentication Header (AH) or the Encapsulating Security Payload (ESP) header.

Fix: F-72189r1_fix

Configure the HP FlexFabric Switch to authenticate OSPFv3 packets: [HP]ipsec transform-set jitcipsecprop [HP-ipsec-transform-set-jitcipsecprop] [HP-ipsec-transform-set-jitcipsecprop] ipsec transform-set jitcipsecprop [HP-ipsec-transform-set-jitcipsecprop] encapsulation-mode transport [HP-ipsec-transform-set-jitcipsecprop] esp encryption-algorithm aes-cbc-256 [HP-ipsec-transform-set-jitcipsecprop] esp authentication-algorithm sha1 [HP-ipsec-transform-set-jitcipsecprop] quit [HP] ipsec profile jitc manual [HP-ipsec-profile-manual-jitc] [HP-ipsec-profile-manual-jitc] ipsec profile jitc manual [HP-ipsec-profile-manual-jitc] transform-set jitcipsecprop [HP-ipsec-profile-manual-jitc] sa spi inbound esp 256 [HP-ipsec-profile-manual-jitc] sa string-key inbound esp simple test123 [HP-ipsec-profile-manual-jitc] sa spi outbound esp 256 [HP-ipsec-profile-manual-jitc] sa string-key outbound esp simple test123 [HP-ipsec-profile-manual-jitc] quit [HP] interface gigabitethernet 0/1 [HP--GigabitEthernet0/1] ospfv3 ipsec-profile jitc

b
The HP FlexFabric Switch must enforce that Interior Gateway Protocol (IGP) instances configured on the out-of-band management gateway only peer with their own routing domain.
AC-4 - Medium - CCI-001414 - V-66115 - SV-80605r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000014
Vuln IDs
  • V-66115
Rule IDs
  • SV-80605r1_rule
If the gateway router is not a dedicated device for the out-of-band management network, implementation of several safeguards for containment of management and production traffic boundaries must occur. Since the managed and management network are separate routing domains, configuration of separate Interior Gateway Protocol routing instances is critical on the router to segregate traffic from each network.
Checks: C-66761r1_chk

Review the configuration to verify the management interface belongs to a different OSPF instance (process) than the production network. If the management interface does not belong to a different OSPF instance, this is a finding.

Fix: F-72191r1_fix

If OSPF is used for the management network, configure the management interface to belong to a different OSPF instance than the production network.

b
The HP FlexFabric Switch must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol (IGP) instances are not redistributed or advertised to each other.
AC-4 - Medium - CCI-001414 - V-66117 - SV-80607r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000015
Vuln IDs
  • V-66117
Rule IDs
  • SV-80607r1_rule
If the gateway router is not a dedicated device for the out-of-band management network, several safeguards must be implemented for containment of management and production traffic boundaries, otherwise, it is possible that management traffic will not be separated from production traffic. Since the managed network and the management network are separate routing domains, separate Interior Gateway Protocol routing instances must be configured on the router, one for the managed network and one for the out-of-band management network. In addition, the routes from the two domains must not be redistributed to each other.
Checks: C-66763r1_chk

Review the configuration to verify the management interface belongs to a different OSPF instance (process) than the production network. If the management interface does not belong to a different OSPF instance, this is a finding.

Fix: F-72193r1_fix

If OSPF is used for the management network, configure the management interface to belong to a different OSPF instance than the production network.

b
The HP FlexFabric Switch must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol (IGP) that is utilized on that management interface.
AC-4 - Medium - CCI-001414 - V-66119 - SV-80609r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000016
Vuln IDs
  • V-66119
Rule IDs
  • SV-80609r1_rule
The out-of-band management access switch will connect to the management interface of the managed network elements. The management interface can be a true out-of-band management interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will directly connect to the out-of-band management network. An out-of-band management interface does not forward transit traffic, thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an out-of-band management port, the interface functioning as the management interface must be configured so that management traffic, both data plane and control plane, does not leak into the managed network and that production traffic does not leak into the management network.
Checks: C-66765r1_chk

Review the configuration to verify the OOBM interface belongs to a different OSPF instance (process) than the production network. If the management interface does not belong to a different OSPF instance, this is a finding. Note: By default an OOBM interface is passive to a routing protocol.

Fix: F-72195r1_fix

If OSPF is used for the management network, configure the OOBM interface to belong to a different OSPF instance than the production network.

b
The HP FlexFabric Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
SC-5 - Medium - CCI-001094 - V-66121 - SV-80611r1_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-001094
Version
HFFS-RT-000017
Vuln IDs
  • V-66121
Rule IDs
  • SV-80611r1_rule
A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, which then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. The router must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) strict mode or by implementing an egress ACL. Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet.
Checks: C-66767r1_chk

Display the switch configuration to verify that either the command ip urpf strict has been configured or an egress filter has been configured on all internal-facing interfaces to drop all outbound packets with an illegitimate source address. If uRPF or an egress filter to restrict the switch from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal-facing interfaces, this is a finding.

Fix: F-72197r1_fix

Configure the global command ip urpf strict on the switch.

b
The HP FlexFabric Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
SC-5 - Medium - CCI-001095 - V-66123 - SV-80613r2_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-001095
Version
HFFS-RT-000018
Vuln IDs
  • V-66123
Rule IDs
  • SV-80613r2_rule
Denial of service is a condition when a resource is not available for legitimate users. Packet flooding DDoS attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch using readily available tools such as Low Orbit Ion Cannon or by botnets. Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages).
Checks: C-66769r1_chk

Interview the system administrator to determine the requirements for bandwidth and traffic prioritization. Display the HP FlexFabric Switch configuration to ensure that the HP FlexFabric Switch is configured with these requirements. If excess bandwidth is not managed to limit the effects of packet flooding types of denial of service (DoS) attacks, this is a finding [HP] display current interface serial10/0 # interface Serial10/0 description IUT 2M-SERIAL virtualbaudrate 2048000 qos reserved-bandwidth pct 100 qos flow-interval 1 qos apply policy JITC-2M-SERIAL outbound undo ipv6 nd ra halt #

Fix: F-72199r1_fix

Implement a mechanism for traffic prioritization and bandwidth reservation. This mechanism must enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies. traffic classifier VOICE operator or if-match dscp 49 # traffic behavior VOICE-2M-SERIAL traffic-policy NEST_EF gts cir 441 cbs 2757 ebs 0 queue-length 50 queue ef bandwidth pct 25 cbs-ratio 25 # traffic classifier VIDEO operator or if-matdscp 39 # traffic behavior VIDEO-2M-SERIAL traffic-policy NEST_AF gts cir 301 cbs 1882 ebs 0 queue-length 50 queue af bandwidth pct 15 # traffic classifier DATA operator or if-match dscp 11 # traffic behavior DATA-2M-SERIAL traffic-policy NEST_AF gts cir 778 cbs 4863 ebs 0 queue-length 50 queue af bandwidth pct 40 # qos policy JITC-2M-SERIAL classifier default-class behavior be-bal classifier VOICE behavior VOICE-2M-SERIAL classifier VIDEO behavior VIDEO-2M-SERIAL classifier DATA behavior DATA-2M-SERIAL # interface Serial10/0 description IUT 2M-SERIAL virtualbaudrate 2048000 qos reserved-bandwidth pct 100 qos flow-interval 1 qos apply policy JITC-2M-SERIAL outbound undo ipv6 nd ra halt

b
The HP FlexFabric Switch must configure the maximum hop limit value to at least 32.
SC-7 - Medium - CCI-001097 - V-66125 - SV-80615r2_rule
RMF Control
SC-7
Severity
Medium
CCI
CCI-001097
Version
HFFS-RT-000019
Vuln IDs
  • V-66125
Rule IDs
  • SV-80615r2_rule
The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached their destination.
Checks: C-66771r1_chk

Review the HP FlexFabric Switch configuration to determine if the maximum hop limit has been configured. If the maximum hop limit is not configured, this is a finding. If it has been configured, then it must be set to at least 32; otherwise this is a finding. [5900CP]display current-configuration | i hop-limit ipv6 hop-limit 255 Note: The default value for the maximum hop limit is 64.

Fix: F-72201r1_fix

If the max hop set is not configured then use the following command to configure it: [HP] ipv6 hop-limit 255

b
The HP FlexFabric Switch must protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.
SC-5 - Medium - CCI-002385 - V-66127 - SV-80617r1_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-002385
Version
HFFS-RT-000020
Vuln IDs
  • V-66127
Rule IDs
  • SV-80617r1_rule
The Route Processor (RP) is critical to all network operations because it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Any disruption to the Route Processor or the control and management planes can result in mission-critical network outages. A DoS attack targeting the Route Processor can result in excessive CPU and memory utilization. To maintain network stability and Route Processor security, the router must be able to handle specific control plane and management plane traffic that is destined to the Route Processor. In the past, one method of filtering was to use ingress filters on forwarding interfaces to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing increases the security of routers and multilayer switches by protecting the Route Processor from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks, allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.
Checks: C-66773r1_chk

Verify that there is a control plane policy configured on the HP FlexFabric to rate limit control plane traffic using the following command: display qos policy control-plane slot 1. If the HP FlexFabric Switch is not configured to rate limit control plane traffic, this is a finding.

Fix: F-72203r1_fix

1. Classify control plane traffic traffic classifier Class-Control-Plane operator or if-match control-plane protocol ospf bgp 2. Create policer to rate limit the control plane traffic traffic behavior Police-Control-Plane car cir nnn cbs nnnn ebs 0 green pass red discard yellow pass 3. Create QoS policy using the traffic classifier and traffic behavior qos policy Policy-Control-Plane classifier Class-Control-Plane behavior Police-Control-Plane 4. Apply the QoS policy to rate limit control-plane traffic control-plane slot 1 qos apply policy Policy-Control-Plane inbound

b
The HP FlexFabric Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.
SC-7 - Medium - CCI-002403 - V-66129 - SV-80619r1_rule
RMF Control
SC-7
Severity
Medium
CCI
CCI-002403
Version
HFFS-RT-000021
Vuln IDs
  • V-66129
Rule IDs
  • SV-80619r1_rule
Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Traffic can be restricted directly by an ACL (which is a firewall function) or by Policy Routing. Policy Routing is a technique used to make routing decisions based on a number of different criteria other than just the destination network, including source or destination network, source or destination address, source or destination port, protocol, packet size, and packet classification. This overrides the router's normal routing procedures used to control the specific paths of network traffic. It is normally used for traffic engineering, but can also be used to meet security requirements; for example, traffic that is not allowed can be routed to the Null0 or discard interface. Policy Routing can also be used to control which prefixes appear in the routing table. Traffic can be restricted directly by an ACL (which is a firewall function), or by Policy Routing. This requirement is intended to allow network administrators the flexibility to use whatever technique is most effective.
Checks: C-66775r1_chk

Review the HP FlexFabric Switch configuration to determine if the switch only allows incoming communications from authorized sources to be routed to authorized destinations. This requirement can be met by applying an ingress filter to an external-facing interface as shown in the following example: acl number 3001 rule 1 deny ip source 192.168.3.121 0 rule 2 permit ip source 192.100.1.0 0.0.0.255 destination 192.200.2.0 0.0.0.255 interface Ten-GigabitEthernet1/0/21 ip address 102.17.17.2 255.255.255.252 packet-filter 3001 inbound If the HP FlexFabric Switch allows incoming communications from unauthorized sources or to unauthorized destinations, this is a finding.

Fix: F-72205r1_fix

Configure the HP FlexFabric Switch to only allow incoming communications from authorized sources to be routed to authorized destinations.

b
The HP FlexFabric Switch must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
AC-4 - Medium - CCI-001414 - V-66131 - SV-80621r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000022
Vuln IDs
  • V-66131
Rule IDs
  • SV-80621r1_rule
Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most routers, internal information flow control is a product of system design.
Checks: C-66777r1_chk

Review the HP FlexFabric Switch configuration to determine if the switch enforces approved authorizations for controlling the flow of information between interconnected networks or VLANs in accordance with applicable policy. This requirement can be met through the use of IP access control lists which are applied to specific interfaces inbound or outbound as show in the following example: acl number 3001 rule 1 deny ip source 192.168.3.121 0 rule 2 permit ip source 192.100.1.0 0.0.0.255 destination 192.200.2.0 0.0.0.255 interface Ten-GigabitEthernet1/0/21 ip address 102.17.17.2 255.255.255.252 packet-filter 3001 inbound If the switch does not enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy, this is a finding.

Fix: F-72207r1_fix

Configure the switch to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy using ACLs that are applied to the appropriate interfaces.

b
The HP FlexFabric Switch must ensure all Exterior Border Gateway Protocol (eBGP) HP FlexFabric Switches are configured to use Generalized TTL Security Mechanism (GTSM).
SC-5 - Medium - CCI-002385 - V-66133 - SV-80623r1_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-002385
Version
HFFS-RT-000023
Vuln IDs
  • V-66133
Rule IDs
  • SV-80623r1_rule
As described in RFC 3682, GTSM is designed to protect a router's IP-based control plane from DoS attacks. Many attacks focused on CPU load and line-card overload can be prevented by implementing GTSM on all eBGP speaking routers. GTSM is based on the fact that the vast majority of control plane peering is established between adjacent routers; that is, the eBGP peers are either between connecting interfaces or between loopback interfaces. Since TTL spoofing is considered nearly impossible, a mechanism based on an expected TTL value provides a simple and reasonably robust defense from infrastructure attacks based on forged control plane traffic.
Checks: C-66779r1_chk

Review the HP FlexFabric Switch configuration. If the HP FlexFabric Switch is not configured to use GTSM for all eBGP peering sessions, this is a finding. [HP] display current-configuration # bgp 2000 graceful-restart peer 10.10.10.1 as-number 2000 peer 10.10.10.1 ttl-security hops 254 peer 201.6.1.193 as-number 1473 peer 201.6.1.193 route-update-interval 0 peer 201.6.1.193 password cipher $c$3$6jyBDW1nVs/F0410R54zhmhD1HYhs5I= peer 2115:B:1::C1 as-number 1473 peer 2115:B:1::C1 route-update-interval 0

Fix: F-72209r1_fix

Configure all eBGP peering sessions to use GTSM. [HP] bgp 2000 [HP-bgp] peer 192.178.19.1 as-number 2100 [HP-bgp] peer 192.178.19.1 ttl-security hops 254

b
The HP FlexFabric Switch must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
AC-4 - Medium - CCI-001414 - V-66135 - SV-80625r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000024
Vuln IDs
  • V-66135
Rule IDs
  • SV-80625r1_rule
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Limiting where, within the network, a given multicast group's data is permitted to flow is an important first step in improving multicast security. A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"; that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Therefore, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once this is done, the zones can be scoped as required.
Checks: C-66781r1_chk

Review the multicast topology diagram and determine which HP FlexFabric Switch interfaces should have Protocol Independent Multicast enabled. Disable PIM on interfaces that should not have it enabled. If PIM is enabled interfaces that are not required to support multicast routing, this is a finding. [HP]display current-configuration interface interface GigabitEthernet0/1 port link-mode route pim sm ip address 192.168.10.1 255.255.255.0 packet-filter 3010 inbound [HP FlexFabric SwitchD] display pim neighbor Total Number of Neighbors = 3 Neighbor Interface Uptime Expires Dr-Priority 192.168.10.2 GE0/1 00:02:22 00:01:27 1

Fix: F-72211r1_fix

Disable PIM on the HP FlexFabric Switch interfaces that should not have it enabled: [HP-GigabitEthernet0/1] undo pim sm

b
The HP FlexFabric Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
AC-4 - Medium - CCI-001414 - V-66137 - SV-80627r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000025
Vuln IDs
  • V-66137
Rule IDs
  • SV-80627r1_rule
Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution trees for forwarding multicast traffic across the network infrastructure. Protocol Independent Multicast traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled. If a PIM neighbor filter is not applied to those interfaces that have PIM enabled, an unauthorized routers can join the PIM domain and discover and use the rendezvous points, and also advertise their rendezvous points into the domain. This can result in a denial of service by traffic flooding or result in the unauthorized transfer of data.
Checks: C-66783r1_chk

Review the multicast topology diagram and determine if the HP FlexFabric Switch interfaces are enabled for IPv4 or IPv6 multicast routing. If the HP FlexFabric Switch is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors. If a PIM neighbor filter is not configured on all multicast-enabled interfaces, this is a finding. display interface GigabitEthernet 0/1 interface GigabitEthernet0/1 port link-mode route description IUT 4GE-HMIM ip address 15.252.78.69 255.255.255.0 pim sm pim neighbor-policy 2000 ipv6 pim sm ipv6 pim neighbor-policy 2000 [HP]display acl 2000 Basic ACL 2000, named -none-, 3 rules, ACL's step is 5 rule 0 permit source 224.200.100.10 0 rule 5 permit source 224.200.101.11 0 rule 10 deny

Fix: F-72213r1_fix

Configure neighbor filters to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor filters to all PIM enabled interfaces using the example bellow. acl basic 2000 rule 0 permit source 224.200.100.10 0 rule 5 permit source 224.200.101.11 0 rule 10 deny source any interface GigabitEthernet0/1 pim neighbor-policy 2000

b
The HP FlexFabric Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.
AC-4 - Medium - CCI-001414 - V-66139 - SV-80629r1_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
HFFS-RT-000026
Vuln IDs
  • V-66139
Rule IDs
  • SV-80629r1_rule
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Administrative scoped multicast traffic must not cross the enclave perimeter in either direction. Restricting multicast traffic makes it more difficult for a malicious user to access sensitive traffic. Admin-Local scope is encouraged for any multicast traffic within a network intended for network management, as well as for control plane traffic that must reach beyond link-local destinations.
Checks: C-66785r1_chk

Review the multicast topology diagram to determine if there are any documented Admin-Local (FFx4::/16), Site-Local (FFx5::/16), or Organization-Local (FFx8::/16) multicast boundaries for IPv6 traffic or any Local-Scope (239.255.0.0/16) boundaries for IPv4 traffic. Verify the appropriate boundaries are configured on the applicable multicast-enabled interfaces. If appropriate multicast scope boundaries have not been configured, this is a finding. [HP] display current-configuration interface GigabitEthernet 0/2 interface GigabitEthernet0/2 port link-mode route description OVERSUBSCRIBE ip address 201.6.36.1 255.255.255.0 multicast boundary 239.255.0.0 16 ipv6 multicast boundary scope 4 ipv6 multicast boundary scope 5 ipv6 multicast boundary scope 8 ipv6 address 2115:C:24::1/120

Fix: F-72215r1_fix

Configure the appropriate boundaries to contain packets addressed within the administratively scoped zone. Defined multicast addresses are FFx4::/16, FFx5::/16, FFx8::/16, and 239.255.0.0/16. Enable ip multicast globally [HP] ipv6 multicast routing Specify the IPv6 multicast boundary on multicast enabled interface [HP] interface gig 0/2 [HP-GigabitEthernet0/2] ipv6 multicast boundary scope 4 [HP-GigabitEthernet0/2] ipv6 multicast boundary scope 5 [HP-GigabitEthernet0/2] ipv6 multicast boundary scope 8 specify the IPv4 multicast boundary on multicast enabled interfaces [HP-GigabitEthernet0/2] multicast boundary 239.255.0.0 16