Infrastructure Router Juniper V8R27

a

The network device must log all access control lists (ACL) deny statements.

Low - V-3000 - SV-15475r3_rule

RMF Control

Severity

L

CCI

Version

NET1020

Vuln IDs

V-3000

Rule IDs

SV-15475r3_rule

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.Information Assurance OfficerECAT-1, ECAT-2, ECSC-1

Checks: C-12941r3_chk

Review the network device interface ACLs to verify all deny statements are logged. Either the syslog or log action command will satisfy this requirement. JUNOS Example: [edit firewall] family inet { filter NIPRNet-ingress { term first-accept { from { } then accept; } term last-accept { from { destination-address { 131.77.5.32/32; 131.77.5.61/32; } protocol tcp; destination-port http; } then accept; } term default-action { then { syslog; discard; } } } }

Fix: F-3025r4_fix

Configure interface ACLs to log all deny statements.

b

The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network.

Medium - V-3008 - SV-3008r1_rule

RMF Control

Severity

M

CCI

Version

NET1800

Vuln IDs

V-3008

Rule IDs

SV-3008r1_rule

Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.Information Assurance Officer

Checks: C-3837r1_chk

Have the SA display the configuration settings that enable this feature. Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples: In CISCO Router(config)# crypto ipsec transform-set transform-set-name transform1 Router(cfg-crypto-tran)# mode tunnel OR in Junos edit security ipsec security-association sa-name] mode tunnel

Fix: F-3033r1_fix

Establish the VPN as a tunneled VPN. Terminate the tunneled VPN outside of the firewall. Ensure all host-to-host VPN are established between trusted known hosts.

c

Network devices must be password protected.

High - V-3012 - SV-3012r4_rule

RMF Control

Severity

H

CCI

Version

NET0230

Vuln IDs

V-3012

Rule IDs

SV-3012r4_rule

Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance Officer

Checks: C-3456r6_chk

Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required. If passwords aren't used to administrative access to the device, this is a finding.

Fix: F-3037r6_fix

Configure the network devices so it will require a password to gain administrative access to the device.

b

Network devices must display the DoD-approved logon banner warning.

Medium - V-3013 - SV-3013r4_rule

RMF Control

Severity

M

CCI

Version

NET0340

Vuln IDs

V-3013

Rule IDs

SV-3013r4_rule

All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed. DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance Officer

Checks: C-3474r10_chk

Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't." If the device configuration does not have a logon banner as stated above, this is a finding.

Fix: F-3038r8_fix

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows: Option A You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Option B If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

b

The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.

Medium - V-3014 - SV-15454r2_rule

RMF Control

Severity

M

CCI

Version

NET1639

Vuln IDs

V-3014

Rule IDs

SV-15454r2_rule

Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks: C-12919r3_chk

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example: [edit system login] class superuser-local { idle-timeout 10; permissions all; } Note: There is no default idle-timeout; hence, without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class. When ssh is enabled, all users can use it to access the router---including the root account. This presents two problems: 1) The root account now be accessed using in-band management 2) Since the root account does not belong to a login class, there is no way to set the idle timeout. Access to the root account via ssh must be disabled via root-login deny command. Following is an example configuration: [edit system] services { ssh { root-login deny;

Fix: F-3039r5_fix

Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

a

The network element must have DNS servers defined if it is configured as a client resolver.

Low - V-3020 - SV-15331r2_rule

RMF Control

Severity

L

CCI

Version

NET0820

Vuln IDs

V-3020

Rule IDs

SV-15331r2_rule

The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.Information Assurance Officer

Checks: C-12797r2_chk

Review the active configuration to ensure that DNS servers have been defined similar to the following example: [edit system] name server { 192.168.1.253; 192.168.1.254; } Note: Since JUNOS will not send a DNS query to resolve names to IP addresses if a name server is not defined, this will never be a finding.

Fix: F-3045r2_fix

Configure the device to include DNS servers or disable domain lookup.

b

The network element must only allow write and poll SNMP access by authorized internal IP addresses.

Medium - V-3021 - SV-15333r2_rule

RMF Control

Severity

M

CCI

Version

NET0890

Vuln IDs

V-3021

Rule IDs

SV-15333r2_rule

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assurance Officer

Checks: C-12799r3_chk

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example: snmp { interface ge-0/1/0.0; community xxxxxxxxx { authorization read-only; clients { default restrict; 7.7.7.5/32; } } } Note: if the clients statement is not present, then all clients are allowed.

Fix: F-3046r4_fix

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

b

The network element must authenticate all IGP peers.

Medium - V-3034 - SV-15291r2_rule

RMF Control

Severity

M

CCI

Version

NET0400

Vuln IDs

V-3034

Rule IDs

SV-15291r2_rule

A rogue router could send a fictitious routing update to convince a site’s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks.Information Assurance Officer

Checks: C-3489r4_chk

Review the device configuration to determine if authentication is configured for all IGP peers. If authentication is not configured for all IGP peers, this is a finding.

Fix: F-3059r3_fix

Configure authentication for all IGP peers.

b

The network device must use different SNMP community names or groups for various levels of read and write access.

Medium - V-3043 - SV-3043r4_rule

RMF Control

Severity

M

CCI

Version

NET1675

Vuln IDs

V-3043

Rule IDs

SV-3043r4_rule

Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance Officer

Checks: C-3825r7_chk

Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access. If unique community strings or accounts are not used for SNMP peers, this is a finding.

Fix: F-3068r4_fix

Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.

c

Group accounts must not be configured for use on the network device.

High - V-3056 - SV-3056r7_rule

RMF Control

Severity

H

CCI

Version

NET0460

Vuln IDs

V-3056

Rule IDs

SV-3056r7_rule

Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance Officer

Checks: C-3503r11_chk

Review the network device configuration and validate there are no group accounts configured for access. If a group account is configured on the device, this is a finding.

Fix: F-3081r9_fix

Configure individual user accounts for each authorized person then remove any group accounts.

b

Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.

Medium - V-3057 - SV-15472r4_rule

RMF Control

Severity

M

CCI

Version

NET0465

Vuln IDs

V-3057

Rule IDs

SV-15472r4_rule

By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance Officer

Checks: C-12938r5_chk

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding. Below is an example configuration with three levels of authorization followed by account templates. [edit system login] class tier1 { idle-timeout 15; permissions [configure interface network routing snmp system trace view firewall ]; } class tier2 { idle-timeout 15; permissions [admin clear configure interface network reset routing routing-control snmp snmp-control system system-control trace trace-control view maintenance firewall firewall-control secret rollback ]; } class tier3 { idle-timeout 15; permissions all; } /* This is our local superuser account with a local password. */ user admin { full-name Administrator; uid 2000; class tier3; authentication { encrypted-password xxxxxxx; } } /* TACACS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } user tier3 { uid 2003; class tier3; } Using the example JUNOS configuration above and TACACS configuration below, when a user is using a template account, the CLI username is the login name; however, the privileges, file ownership, and effective user ID are inherited from the template account. The CLI username is sent to the authentication server with the correct password. The server returns the local username (i.e., “tier2”) to the JUNOS software as specified in the authentication server (local-user-name for TACACS+, Juniper-Local-User for RADIUS). user = simon { . . . . service = junos-exec { local-user-name = tier2 allow-commands = "configure" deny-commands = "shutdown" } } 'allow-commands' and 'deny-commands' override permissions of the class of the template that the local-user-name is associated with.

Fix: F-3082r5_fix

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

b

Unauthorized accounts must not be configured for access to the network device.

Medium - V-3058 - SV-3058r5_rule

RMF Control

Severity

M

CCI

Version

NET0470

Vuln IDs

V-3058

Rule IDs

SV-3058r5_rule

A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance Officer

Checks: C-3505r5_chk

Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device. If an unauthorized account is configured for access to the device, this is a finding.

Fix: F-3083r5_fix

Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.

c

The network element must be configured to ensure passwords are not viewable when displaying configuration information.

High - V-3062 - SV-41451r2_rule

RMF Control

Severity

H

CCI

Version

NET0600

Vuln IDs

V-3062

Rule IDs

SV-41451r2_rule

Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration. Information Assurance OfficerECSC-1

Checks: C-39962r3_chk

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

Fix: F-40533r1_fix

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

b

Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.

Medium - V-3069 - SV-15452r4_rule

RMF Control

Severity

M

CCI

Version

NET1638

Vuln IDs

V-3069

Rule IDs

SV-15452r4_rule

Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Checks: C-12917r6_chk

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS -SSL -TLS JUNOS Example: [edit system services] ssh { root-login (allow | deny | deny-password); protocol-version [ v2 ]; macs [hmac-sha1 hmac-sha1-96]; ciphers [aes128-cbc aes192-cbc aes256-cbc]; } [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } … [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port ssh; } then { syslog; accept; } } … term default-action { then { syslog; discard; } } } } If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

Fix: F-3094r5_fix

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

a

The network element must log all attempts to establish a management connection for administrative access.

Low - V-3070 - SV-15456r2_rule

RMF Control

Severity

L

CCI

Version

NET1640

Vuln IDs

V-3070

Rule IDs

SV-15456r2_rule

Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance Officer

Checks: C-12921r3_chk

Review the router configurations and verify that all ssh connection attempts are logged. The configuration should look similar to the following: [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port [ssh]; } then { syslog; accept; } } term default-action { then { syslog; discard; } } } }

Fix: F-3095r3_fix

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

a

The network element must have the Finger service disabled.

Low - V-3079 - SV-15306r2_rule

RMF Control

Severity

L

CCI

Version

NET0730

Vuln IDs

V-3079

Rule IDs

SV-15306r2_rule

The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information. Information Assurance Officer

Checks: C-12702r2_chk

Under the edit system services hierarchy, enter a show command to verify that the finger command is not present.

Fix: F-3104r4_fix

Configure the device to disable the Finger service.

b

The router must have IP source routing disabled.

Medium - V-3081 - SV-15317r2_rule

RMF Control

Severity

M

CCI

Version

NET0770

Vuln IDs

V-3081

Rule IDs

SV-15317r2_rule

Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance Officer

Checks: C-12783r2_chk

Under the edit chassis hierarchy, enter a show command to verify that the no-source-route command is present.

Fix: F-3106r2_fix

Configure the router to disable IP source routing.

b

The network element must have HTTP service for administrative access disabled.

Medium - V-3085 - SV-41468r2_rule

RMF Control

Severity

M

CCI

Version

NET0740

Vuln IDs

V-3085

Rule IDs

SV-41468r2_rule

The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.

Checks: C-39968r2_chk

Under the edit system services hierarchy enter a show command to verify the web-management http command is not present (the web-management https command may be enabled for administrative access). If you are reviewing an entire configuration, verify the web-management http command is not present as shown in the example below: system { services { web-management { http { interface ge-0/0/0.0; } } } } If the HTTP server is enabled, this is a finding.

Fix: F-3110r4_fix

Configure the device to disable using HTTP (port 80) for administrative access.

c

Network devices must not have any default manufacturer passwords.

High - V-3143 - SV-3143r4_rule

RMF Control

Severity

H

CCI

Version

NET0240

Vuln IDs

V-3143

Rule IDs

SV-3143r4_rule

Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance Officer

Checks: C-40236r3_chk

Review the network devices configuration to determine if the vendor default password is active. If any vendor default passwords are used on the device, this is a finding.

Fix: F-35391r3_fix

Remove any vendor default passwords from the network devices configuration.

b

The network element must be running a current and supported operating system with all IAVMs addressed.

Medium - V-3160 - SV-15303r2_rule

RMF Control

Severity

M

CCI

Version

NET0700

Vuln IDs

V-3160

Rule IDs

SV-15303r2_rule

Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance Officer

Checks: C-12698r2_chk

In operational mode, have the router administrator execute the show version brief command to verify the installed JUNOS version. This command will show the base OS as well as the kernel, packet forwarding engine, routing, and crypto. Validate that all software components are at the required level. J, M and T series should be 10.0 or later. E series should be 10.2 or later Verify that all IAVMs have been addressed.

Fix: F-3185r4_fix

Update operating system to a supported version that addresses all related IAVMs.

c

The network device must require authentication prior to establishing a management connection for administrative access.

High - V-3175 - SV-28748r3_rule

RMF Control

Severity

H

CCI

Version

NET1636

Vuln IDs

V-3175

Rule IDs

SV-28748r3_rule

Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerECSC-1

Checks: C-29085r4_chk

Review the network device configuration to verify all management connections for administrative access require authentication. With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. Following is an example: [edit system] authentication-order [ radius password ]; radius-server { 192.168.6.5 { secret "xxxxxxx"; } } login { /* login classes */ class tier1 { idle-timeout 10; permissions all; } class tier2 { idle-timeout 10; permissions [ configure interface network routing snmp system trace view firewall ]; } /* local emgergency account */ user admin { full-name Administrator; uid 2000; class tier1; authentication { encrypted-password "xxxx"; # SECRET-DATA } } /* RADIUS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } } Note: When SSH is enabled, all users can use this service to access the router---including the root account. Access to the root account via SSH must be disabled via root-login deny command. Following is an example configuration: [edit system] services { ssh { root-login deny;

Fix: F-3200r3_fix

Configure authentication for all management connections.

c

The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.

High - V-3196 - SV-3196r4_rule

RMF Control

Severity

H

CCI

Version

NET1660

Vuln IDs

V-3196

Rule IDs

SV-3196r4_rule

SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance Officer

Checks: C-3820r6_chk

Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption. Downgrades: If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II. If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III. If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model. If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.

Fix: F-3221r5_fix

If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).

c

The network device must not use the default or well-known SNMP community strings public and private.

High - V-3210 - SV-3210r4_rule

RMF Control

Severity

H

CCI

Version

NET1665

Vuln IDs

V-3210

Rule IDs

SV-3210r4_rule

Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance Officer

Checks: C-3822r7_chk

Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used. If default or well-known community strings are used for SNMP, this is a finding.

Fix: F-3235r4_fix

Configure unique SNMP community strings replacing the default community strings.

b

In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.

Medium - V-3966 - SV-30085r5_rule

RMF Control

Severity

M

CCI

Version

NET0440

Vuln IDs

V-3966

Rule IDs

SV-30085r5_rule

Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.

Checks: C-12936r5_chk

Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency. Example: [edit system] class tier3 { idle-timeout 15; permissions all; } user admin { full-name Administrator; uid 2000; class tier3; authentication { encrypted-password xxxxxxxxxxx; } } Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe. If an authentication server is used and more than one local account exists, this is a finding.

Fix: F-3899r9_fix

Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.

b

The network element must time out access to the console port after 10 minutes or less of inactivity.

Medium - V-3967 - SV-15445r2_rule

RMF Control

Severity

M

CCI

Version

NET1624

Vuln IDs

V-3967

Rule IDs

SV-15445r2_rule

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks: C-12910r2_chk

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example: [edit system login] class superuser-local { idle-timeout 10; permissions all; } Notes: 1. There is no default idle-timeout. Without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class. 2. Since the root account does not belong to a class and you can access root via console, disable the ability to login using the root account by making the console insecure as follows: [edit system] console { insecure; }

Fix: F-3900r4_fix

Configure the timeout for idle console connection to 10 minutes or less.

b

The network device must only allow SNMP read-only access.

Medium - V-3969 - SV-30087r3_rule

RMF Control

Severity

M

CCI

Version

NET0894

Vuln IDs

V-3969

Rule IDs

SV-30087r3_rule

Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1

Checks: C-12801r6_chk

Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3. If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding. The SNMP V1 configuration should look similar to the following: snmp { interface ge-0/1/0.0; community xxxxxxxxx { authorization read-only; clients { default restrict; 7.7.7.5/30; } } SNMPv3 access sets the SNMP access levels by context, group, and user. The context-name statement determines what management information is accessible by an SNMP entity. An SNMP entity can have access to many access contexts and therefore requires a name to identify each context. You must also associate a context with a specific access group and configure read and write views associated with each group. Specify the group-name variable to identify a collection of SNMP users that share the same access policy, in which object identifiers (OIDs) are read-accessible or write-accessible. Each group is the collection of users associated with the security model. You can only specify the model usm. The example below as a “router context” which is accessed by two groups: NOC and engineers. NOC is only allowed read access while engineers have read and write access. John and Sue are users that belong to the engineers group and have authentication configured. snmp { view all { oid .1.3.6.1 include; } engine-id { local "isp-routers-0001"; } access { user john { authentication-type md5; authentication-password "john-auth-password"; privacy-type des; privacy-password "john-privacy-password"; } user sue { authentication-type md5; authentication-password "sue-auth-password"; privacy-type des; privacy-password "sue-privacy-password"; } user hpov { authentication-type md5; authentication-password "hpov-auth-password"; privacy-type des; privacy-password "hpov-privacy-password"; } group engineers { model usm; user [john sue]; } group noc { model usm; user hpov; } context router { description “a router context”; group noc { model usm; security-level privacy; read-view all; } group engineers { model usm; security-level privacy; read-view all; write-view all; } } }

Fix: F-3902r7_fix

Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.

c

The network device must require authentication for console access.

High - V-4582 - SV-28747r3_rule

RMF Control

Severity

H

CCI

Version

NET1623

Vuln IDs

V-4582

Rule IDs

SV-28747r3_rule

Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerIAIA-1, IAIA-2

Checks: C-29084r3_chk

Review the network device's configuration and verify authentication is required for console access. With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class as shown in the following example: [edit system] authentication-order [ radius password ]; radius-server { 192.168.6.5 { secret "xxxxxxx"; } } login { /* login classes */ class tier1 { idle-timeout 10; permissions all; } class tier2 { idle-timeout 10; permissions [ configure interface network routing snmp system trace view firewall ]; } /* local emgergency account */ user admin { full-name Administrator; uid 2000; class tier1; authentication { encrypted-password "xxxx"; # SECRET-DATA } } /* RADIUS templates */ user tier1 { uid 2001; class tier1; } user tier2 { uid 2002; class tier2; } } Note: Since the root account does not belong to a class and you can access root via console, disable the ability to login at the console using the root account by making the console insecure as follows: [edit system] console { insecure; }

Fix: F-4515r4_fix

Configure authentication for console access on the network device.

a

The router administrator will ensure a password is required to gain access to the router's diagnostics port.

Low - V-4583 - SV-4583r1_rule

RMF Control

Severity

L

CCI

Version

NET0580

Vuln IDs

V-4583

Rule IDs

SV-4583r1_rule

If unauthorized users gain access to the routers diagnostic port, it is possible to disrupt service.Information Assurance Officer

Checks: C-3506r1_chk

IOS Procedure: N/A A Cisco router does not have a diagnostics port. JUNOS Procedure: Review the router configuration to ensure a password is required when gaining access to the diagnostics port similar to the following: [edit system] diag-port-authentication { encrypted-password "xxxxxxxxxxxxx"; # SECRET-DATA }

Fix: F-4516r1_fix

The router administrator will ensure that a password is required to access the routers diagnostic port.

a

The network element must log all messages except debugging and send all log data to a syslog server.

Low - V-4584 - SV-15477r2_rule

RMF Control

Severity

L

CCI

Version

NET1021

Vuln IDs

V-4584

Rule IDs

SV-15477r2_rule

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.Information Assurance Officer

Checks: C-12943r2_chk

Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example: [edit system syslog] syslog { host 192.168.1.22 { any info; facility-override local7; } } The table below lists the severity levels and message types for all log data. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging

Fix: F-4517r6_fix

Configure the network device to log all messages except debugging and send all log data to a syslog server.

b

The network element must only allow management connections for administrative access from hosts residing in to the management network.

Medium - V-5611 - SV-15450r3_rule

RMF Control

Severity

M

CCI

Version

NET1637

Vuln IDs

V-5611

Rule IDs

SV-15450r3_rule

Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Checks: C-12915r3_chk

Review the router configuration and verify that only authorized internal connections are allowed access to the routing engine via ssh. Access to the Juniper routing engine is via loopback interface. The configuration should look similar to the following: [edit interfaces] lo0 { unit 0 { family inet { filter { input protect-routing-engine; } address 192.168.1.2/32; } } } [edit firewall] family inet { filter protect-routing-engine { term terminal-access { from { source-address { 192.168.1.10; 192.168.1.11; } protocol tcp; port ssh; } then { syslog; accept; } } term default-action { then { log; discard; } } } }

Fix: F-5522r4_fix

Configure an ACL or filter to restrict management access to the device from only the management network.

b

The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.

Medium - V-5612 - SV-28744r2_rule

RMF Control

Severity

M

CCI

Version

NET1645

Vuln IDs

V-5612

Rule IDs

SV-28744r2_rule

An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.Information Assurance Officer

Checks: C-29028r3_chk

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period. system { login { retry-options { tries-before-disconnect 3; maximum-time 60; }

Fix: F-5523r5_fix

Configure the network devices so it will require a secure shell timeout of 60 seconds or less.

b

The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.

Medium - V-5613 - SV-28745r2_rule

RMF Control

Severity

M

CCI

Version

NET1646

Vuln IDs

V-5613

Rule IDs

SV-28745r2_rule

An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer

Checks: C-29030r3_chk

Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3. system { login { retry-options { tries-before-disconnect 3; maximum-time 60; }

Fix: F-5524r9_fix

Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.

b

The network device must drop half-open TCP connections through filtering thresholds or timeout periods.

Medium - V-5646 - SV-15437r4_rule

RMF Control

Severity

M

CCI

Version

NET0965

Vuln IDs

V-5646

Rule IDs

SV-15437r4_rule

A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An attacker’s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.Information Assurance OfficerECSC-1

Checks: C-12902r7_chk

Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections. For timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering. JUNOS Configuration Example: firewall { policer TCP-SYN-Policer { if-exceeding { bandwidth-limit 500k; burst-size-limit 15k; } then discard; } family inet { filter DOS-Protect { . . . /* Term tcp-syn-fin-limit: Rate limit TCP packets with SYN/FIN/RST flags. */ term tcp-syn-fin-limit { from { protocol tcp; port [bgp ldp snmp snmptrap telnet ftp ftp-data ssh]; tcp-flags “syn | fin | rst”; } then policer TCP-SYN-Policer; } . . }

Fix: F-5557r6_fix

Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.

a

The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.

Low - V-7011 - SV-15447r2_rule

RMF Control

Severity

L

CCI

Version

NET1629

Vuln IDs

V-7011

Rule IDs

SV-15447r2_rule

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device. Information Assurance Officer

Checks: C-12912r2_chk

Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.If the following configuration statements are found than a secure modem should be in place. [edit system] ports { auxiliary { type vt100; } }

Fix: F-6614r3_fix

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

a

Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less.

Low - V-14667 - SV-15301r4_rule

RMF Control

Severity

L

CCI

Version

NET0422

Vuln IDs

V-14667

Rule IDs

SV-15301r4_rule

If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.

Checks: C-12696r5_chk

Review device configuration for key expirations of 180 days or less. If rotating keys are not configured to expire at 180 days or less, this is a finding.

Fix: F-14125r4_fix

Configure the device so rotating keys expire at 180 days or less.

b

The router administrator will ensure FTP server is disabled.

Medium - V-14668 - SV-15312r1_rule

RMF Control

Severity

M

CCI

Version

NET0742

Vuln IDs

V-14668

Rule IDs

SV-15312r1_rule

The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.Information Assurance Officer

Checks: C-12776r3_chk

Review the device configuration to determine if the device has been setup to be an FTP server. If the device has been configured to be an FTP server, this is a finding.

Fix: F-14129r2_fix

Disable FTP server services on the device.

b

The network element must have all BSDr commands disabled.

Medium - V-14669 - SV-15315r2_rule

RMF Control

Severity

M

CCI

Version

NET0744

Vuln IDs

V-14669

Rule IDs

SV-15315r2_rule

Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a "trusted" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methodsInformation Assurance Officer

Checks: C-12781r2_chk

Under the edit system services hierarchy, enter a show command to verify that the rlogin command is not present.

Fix: F-14130r4_fix

Configure the device to disable BSDr command services.

b

The router administrator will ensure ICMPv6 unreachable notifications, and redirects are disabled on all external interfaces of the premise router.

Medium - V-14670 - SV-15322r1_rule

RMF Control

Severity

M

CCI

Version

NET0802

Vuln IDs

V-14670

Rule IDs

SV-15322r1_rule

The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.Information Assurance Officer

Checks: C-12786r1_chk

Review the active configuration to determine if controls have been defined to ensure router has ICMPv6 unreachables or redirects disabled any external interfaces.

Fix: F-14131r1_fix

The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.

b

The network element must authenticate all NTP messages received from NTP servers and peers.

Medium - V-14671 - SV-41501r3_rule

RMF Control

Severity

M

CCI

Version

NET0813

Vuln IDs

V-14671

Rule IDs

SV-41501r3_rule

Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.

Checks: C-13750r4_chk

Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Downgrade: If the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III. If the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.

Fix: F-14132r4_fix

Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.

a

The router must use its loopback or OOB management interface address as the source address when originating TACACS+ or RADIUS traffic.

Low - V-14672 - SV-16092r2_rule

RMF Control

Severity

L

CCI

Version

NET0897

Vuln IDs

V-14672

Rule IDs

SV-16092r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks: C-13849r3_chk

Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on JUNOS routers; however, multiple addresses can be defined. Step 2: Verify that TACACS+ and RADIUS are configured to use the loopback address by comparing the source address defined for tacplus-server and radius-server with the address configured for the loopback interface. You should find a configuration similar to the examples below: TACACS+ system { tacplus-server { 10.10.2.11; source-address 10.10.2.1; } } RADIUS system { radius-server { 10.10.2.21; source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Fix: F-14134r5_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.

a

The router must use its loopback or OOB management interface address as the source address when originating syslog traffic.

Low - V-14673 - SV-15341r2_rule

RMF Control

Severity

L

CCI

Version

NET0898

Vuln IDs

V-14673

Rule IDs

SV-15341r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.Information Assurance Officer

Checks: C-12807r2_chk

Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that syslog is configured to use the loopback address by comparing the source address defined for syslog with the address configured for the loopback interface. You should find a configuration similar to the examples below: system { syslog { host 192.168.1.100 { any info; } source-address 192.168.1.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Fix: F-14135r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.

a

The router must use its loopback or OOB management interface address as the source address when originating NTP traffic.

Low - V-14674 - SV-15344r2_rule

RMF Control

Severity

L

CCI

Version

NET0899

Vuln IDs

V-14674

Rule IDs

SV-15344r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks: C-12810r2_chk

Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that NTP is configured to use the loopback address by comparing the source address defined for NTP with the address configured for the loopback interface. You should find a configuration similar to the examples below: system { ntp { server 10.10.2.21; source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Fix: F-14136r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.

a

The router must use its loopback or OOB management interface address as the source address when originating SNMP traffic.

Low - V-14675 - SV-15347r2_rule

RMF Control

Severity

L

CCI

Version

NET0900

Vuln IDs

V-14675

Rule IDs

SV-15347r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks: C-12813r3_chk

Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Verify that SNMP is configured to use the loopback address by comparing the source address defined for SNMP with the address configured for the loopback interface. You should find a configuration similar to the examples below: snmp { clients { default restrict; 10.10.2.111/32; } trap-options { source-address 10.10.2.1; } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Fix: F-14137r4_fix

Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.

a

The router must use its loopback or OOB management interface address as the source address when originating NetFlow traffic.

Low - V-14676 - SV-15350r2_rule

RMF Control

Severity

L

CCI

Version

NET0901

Vuln IDs

V-14676

Rule IDs

SV-15350r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Netflow messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks: C-12816r2_chk

Review the configuration and verify the loopback interface address is used as the source address when originating Netflow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following. interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: Juniper has adopted the Cisco PDU format for flow export; However, Juniper does not call it NetFlow but "cflowd" and uses the flow export concept as a means to export packet-sampling data. Juniper has a filtering mechanism which allows you to sample packets and log them to the local file system or they can be exported using the "cflowd" forwarding options. You should find a configuration similar to the example below depicting the source address for cflowd: forwarding-options { sampling { input { family inet { rate 100; run-length 4; max-packets-per-second 5000; } } output { cflowd 10.10.2.22 { port 9991; source-address 10.10.2.1; } } } Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows: system { default-address-selection; … } }

Fix: F-14138r2_fix

Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.

a

The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

Low - V-14677 - SV-15353r3_rule

RMF Control

Severity

L

CCI

Version

NET0902

Vuln IDs

V-14677

Rule IDs

SV-15353r3_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks: C-12820r4_chk

Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address x.x.x.x/32; } } } Step 2: There is no method to override the source address default for TFTP and FTP. Hence, the router must be configured to use the loopback as the default source address for all locally generated traffic. This is accomplished by configuring the default-address-selection statement as shown in the following example: system { default-address-selection; … } } If the device is managed from an OOB management network, the OOB interface must be used instead. Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Fix: F-40481r1_fix

Configure the network device to use a loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

a

The router must use its loopback interface address as the source address for all iBGP peering sessions.

Low - V-14681 - SV-15360r2_rule

RMF Control

Severity

L

CCI

Version

NET0903

Vuln IDs

V-14681

Rule IDs

SV-15360r2_rule

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.Information Assurance Officer

Checks: C-12827r2_chk

Review the configuration and verify the loopback interface address is used as the source address for all iBGP peering. Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { address 10.10.2.1/32; } } } Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined. Step 2: The vulnerability does not require eBGP peering to use the loopback address. Hence, the BGP router only requires that the loopback address is used to peer with its iBGP neighbors. You should find a configuration similar to the example below: protocols { bgp { group iBGP_111 { type internal; local-address 10.10.2.1; export next-hop-self; peer-as 111; neighbor 10.10.2.2; } } }

Fix: F-14148r3_fix

Configure the network device's loopback address as the source address for iBGP peering.

b

The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF.

Medium - V-14693 - SV-15397r2_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-025

Vuln IDs

V-14693

Rule IDs

SV-15397r2_rule

As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.Information Assurance OfficerECSC-1

Checks: C-12864r2_chk

Review the device configuration to ensure FEC0::/10 IP addresses are not defined. If FEC0::/10 IP addresses are defined, this is a finding.

Fix: F-14158r1_fix

Configure the device using authorized IP addresses.

b

The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave.

Medium - V-14707 - SV-15430r1_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-034

Vuln IDs

V-14707

Rule IDs

SV-15430r1_rule

Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped. If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address). To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes. Information Assurance Officer

Checks: C-12894r1_chk

Unicast Strict mode: Review the router configuration to ensure uRPF has been configured on all internal interfaces.

Fix: F-14172r1_fix

The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.

b

The network element must not use SSH Version 1 for administrative access.

Medium - V-14717 - SV-15461r2_rule

RMF Control

Severity

M

CCI

Version

NET1647

Vuln IDs

V-14717

Rule IDs

SV-15461r2_rule

SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. Information Assurance Officer

Checks: C-12926r2_chk

If SSH is used for administrative access, then Version 2 must be configured as shown in the following example: system { services { ssh { protocol-version v2; } } }

Fix: F-14184r5_fix

Configure the network device to use SSH version 2.

b

ISATAP tunnels must terminate at an interior router.

Medium - V-15288 - SV-16067r2_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-017

Vuln IDs

V-15288

Rule IDs

SV-16067r2_rule

ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.Information Assurance OfficerECSC-1

Checks: C-13686r5_chk

Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.

Fix: F-14730r6_fix

Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.

b

Network devices must use two or more authentication servers for the purpose of granting administrative access.

Medium - V-15432 - SV-16259r4_rule

RMF Control

Severity

M

CCI

Version

NET0433

Vuln IDs

V-15432

Rule IDs

SV-16259r4_rule

The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity. The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance Officer

Checks: C-14439r6_chk

Verify an authentication server is required to access the device and that there are two or more authentication servers defined. If the device is not configured for two separate authentication servers, this is a finding.

Fix: F-15096r3_fix

Configure the device to use two separate authentication servers.

c

The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.

High - V-15434 - SV-16261r5_rule

RMF Control

Severity

H

CCI

Version

NET0441

Vuln IDs

V-15434

Rule IDs

SV-16261r5_rule

The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance Officer

Checks: C-14441r6_chk

Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online. If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.

Fix: F-15098r7_fix

Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.

b

IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address.

Medium - V-17754 - SV-18945r2_rule

RMF Control

Severity

M

CCI

Version

NET1807

Vuln IDs

V-17754

Rule IDs

SV-18945r2_rule

The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.Information Assurance Officer

Checks: C-19015r3_chk

Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network. If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.

Fix: F-17652r2_fix

Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.

b

Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway

Medium - V-17814 - SV-19063r1_rule

RMF Control

Severity

M

CCI

Version

NET1808

Vuln IDs

V-17814

Rule IDs

SV-19063r1_rule

The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.System AdministratorInformation Assurance Officer

Checks: C-19020r1_chk

Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.

Fix: F-17724r1_fix

Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

b

IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain

Medium - V-17815 - SV-19298r1_rule

RMF Control

Severity

M

CCI

Version

NET0985

Vuln IDs

V-17815

Rule IDs

SV-19298r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. System Administrator

Checks: C-20143r1_chk

Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where RIP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “Enclave Management LAN” unit 0 { family inet { address 10.1.1.1/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { address 10.1.20.3/24; } } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; interface lo0.0; } } rip { group rip-neighbor { neighbor t3-3/0/3.0; export rip-advertisements; } } } policy-options { policy-statement rip-advertisements { from protocol rip; then accept; } } policy-statement direct-management-LAN { from { protocol direct; interface [ lo0.0 t3-3/0/3.0 fe-0/0/2 ]; } then accept; } } Note: When you enable RIP, the default JUNOS behavior is to accept all learned RIP routes but export no routes to RIP neighbors. To have RIP send routing information to its neighbors, you need to configure a routing policy that has RIP export routes to its neighbors. In the example above, the OOBM gateway router will only have a RIP neighbor adjacency with its upstream OOB backbone router. However, it will advertise to the RIP domain the local management address prefix and the loopback address which also belongs to the management network.

Fix: F-17730r1_fix

Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.

b

The routes from the two IGP domains are redistributed to each other.

Medium - V-17816 - SV-19300r1_rule

RMF Control

Severity

M

CCI

Version

NET0986

Vuln IDs

V-17816

Rule IDs

SV-19300r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other. System AdministratorInformation Assurance Officer

Checks: C-20201r1_chk

Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa. There is no equivalent redistribute command in JUNOS. All redistribution of routes between protocols is done through the creation of a routing policy through the use of import and export statements. Verify that there are no export and policy-statement commands configured that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following example illustrates how RIP routes would be redistributing into OSPF. policy-options { policy-statement rip-to-ospf { from protocol rip; then accept; } } } protocols { ospf { export rip-to-ospf; area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; } } As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well. If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { address 10.1.20.3/24; } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; interface lo0.0; } } routing-options { static { route 10.1.1.0/24 { next-hop 10.1.20.4; } } }

Fix: F-17731r1_fix

Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.

b

Traffic from the managed network is able to access the OOBM gateway router

Medium - V-17817 - SV-19302r2_rule

RMF Control

Severity

M

CCI

Version

NET0987

Vuln IDs

V-17817

Rule IDs

SV-19302r2_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.System AdministratorInformation Assurance Officer

Checks: C-20203r1_chk

Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic. Step 1: Verify that an inbound filter has been applied to loopback interface. This filter is used to restrict all traffic to the router engine. The interface configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { no-redirects; filter { input router-protect-filter; } address 10.1.3.41/32; } } } } Note: the address block used for loopback addresses should be independent of the address space used for the management backbone, the NOC, or the local management subnet. Loopback address should be configured with /32 prefixes to enable proper route advertisements and optimum path reachability for both control plane and management plane traffic within the global management network. Step 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC. Step 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The filter configuration should look similar to the following: firewall { filter router-protect-filter { term ospf-neighbors { from { source-address { 10.2.2.0/24; } protocol ospf; } then { syslog; accept; } } term ssh-access { from { source-address { 10.2.2.0/24; } protocol tcp; destination-port ssh; } then { syslog; accept; } } term snmp-access { from { source-address { 10.2.2.24/32; 10.2.2.25/32; } protocol udp; destination-port snmp; } then { syslog; accept; } } term tacacs-access { from { source-address { 10.2.2.30/32; } protocol tcp; port tacacs-ds; } then { syslog; accept; } } term ftp-access { from { source-address { 10.2.2.77/32; } protocol tcp; port [ftp ftp-data]; } then { syslog; accept; } } term allow-ICMP { from { source-address { 10.2.2.0/24; } protocol icmp; } then accept; } term default-action { then { syslog; discard; } } } }

Fix: F-17732r1_fix

Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.

b

Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone.

Medium - V-17818 - SV-19304r1_rule

RMF Control

Severity

M

CCI

Version

NET0988

Vuln IDs

V-17818

Rule IDs

SV-19304r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks. System AdministratorInformation Assurance Officer

Checks: C-20205r1_chk

Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { filter { output OOBM-egress-filter; } address 10.1.20.3/24; } } } } firewall { filter OOBM-egress-filter { term allow-mgmt { from { source-address { 10.1.1.0/24; } destination-address { 10.2.2.0/24; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } }

Fix: F-17733r1_fix

Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.

b

Management network traffic is leaking into the managed network.

Medium - V-17819 - SV-19306r1_rule

RMF Control

Severity

M

CCI

Version

NET0989

Vuln IDs

V-17819

Rule IDs

SV-19306r1_rule

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network’s production address spaces.System AdministratorInformation Assurance Officer

Checks: C-20207r1_chk

Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC. interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { address 10.1.1.2/24; } } } t3-3/0/3 { description “link to OOBM Backbone” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.20.3/24; } } } firewall { filter OOBM-ingress-filter { term allow-mgmt { from { source-address { 10.2.2.0/24; } destination-address { 10.1.1.0/24; } } then { accept; } } … … term default-action { then { syslog; discard; } } } }

Fix: F-17734r2_fix

Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.

b

The network element’s OOBM interface must be configured with an OOBM network address.

Medium - V-17821 - SV-20206r2_rule

RMF Control

Severity

M

CCI

Version

NET0991

Vuln IDs

V-17821

Rule IDs

SV-20206r2_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance Officer

Checks: C-22336r2_chk

After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24. interfaces { fxp0 { description “link to OOBM access switch” unit 0 { family inet { address 10.1.1.22/24; } } }

Fix: F-17736r2_fix

Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.

b

The management interface is not configured with both an ingress and egress ACL.

Medium - V-17822 - SV-20209r1_rule

RMF Control

Severity

M

CCI

Version

NET0992

Vuln IDs

V-17822

Rule IDs

SV-20209r1_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network System AdministratorInformation Assurance Officer

Checks: C-20311r2_chk

Step 1: Verify that the managed interface has an inbound and outbound filter configured as shown in the following example: interfaces { fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.1.22/24; } } } Step 2: Verify that the ingress filter blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24. firewall { filter OOBM-ingress-filter { term allow-mgmt { from { source-address { 10.2.2.0/24; } destination-address { 10.1.1.22/32; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } } Step 3: Verify that the egress filter blocks any traffic exiting the management interface that was not originated by the managed elements . Verify that the destination address is the NOC address space. firewall { filter OOBM-egress-filter { term allow-mgmt { from { source-address { 10.1.1.22/32; } destination-address { 10.2.2.0/24; } } then { accept; } } … … … term default-action { then { syslog; discard; } } } }

Fix: F-17737r2_fix

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.

a

The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network.

Low - V-17823 - SV-19335r2_rule

RMF Control

Severity

L

CCI

Version

NET0993

Vuln IDs

V-17823

Rule IDs

SV-19335r2_rule

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network. System AdministratorInformation Assurance Officer

Checks: C-20314r4_chk

If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. With JUNOS, routing protocols are enabled on the interfaces by specifying the interface under the routing protocol hierarchy. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface: interfaces { fe-0/0/0 { description “link to our Private Net” unit 0 { family inet { address 172.20.4.2/24; } } } fe-0/0/1 { description “link to our Service Net” unit 0 { family inet { address 172.20.5.2/24; } } } fe-0/0/2 { description “link to our Management LAN” unit 0 { family inet { filter { input OOBM-ingress-filter; output OOBM-egress-filter; } address 10.1.1.22/24; } } } } protocols { ospf { area 0.0.0.0 { interface fe-0/0/0.0; interface fe-0/0/1.0; } } }

Fix: F-17738r2_fix

Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.

b

An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic.

Medium - V-17834 - SV-19309r1_rule

RMF Control

Severity

M

CCI

Version

NET1005

Vuln IDs

V-17834

Rule IDs

SV-19309r1_rule

If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other. System AdministratorInformation Assurance Officer

Checks: C-20258r1_chk

Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration: interfaces fe-1/1/1 { vlan-tagging; unit 10 { family inet { filter { input ingress-mgmt-vlan-filter; } address 10.1.1.1/24; } } } firewall { filter ingress-mgmt-vlan-filter { term …

Fix: F-17751r1_fix

If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.

b

Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address.

Medium - V-17835 - SV-19311r1_rule

RMF Control

Severity

M

CCI

Version

NET1006

Vuln IDs

V-17835

Rule IDs

SV-19311r1_rule

Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. System AdministratorInformation Assurance Officer

Checks: C-20260r1_chk

Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). Example from a show services command with Juniper M or T series router with Adaptive Services PIC using next-hop style is as follows: service-set vpn-to-NOC { next-hop-service { inside-service-interface sp-0/0/0.1; outside-service-interface sp-0/0/0.2; } ipsec-vpn-options { local-gateway 19.16.1.1; } ipsec-vpn-rules site-to-NOC; } ipsec-vpn { rule site-to-NOC { term mgmt-traffic { } destination-address { 10.2.2.0/24; } } then remote-gateway 19.16.2.1; dynamic { ike-policy main_mode_ike_policy; ipsec-policy dynamic_ipsec_policy; } } } match-direction input; } ipsec { proposal esp_sha1_ipsec_prop { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm 3des-cbc; } policy dynamic_ipsec_policy { perfect-forward-secrecy { keys group2; } proposals esp_sha1_ipsec_prop; } } ike { proposal psk_sha1_3des_ike_prop { authentication-method pre-shared-keys; authentication-algorithm sha1; encryption-algorithm 3des-cbc; } policy main_mode_ike_policy { mode main; proposals psk_sha1_3des_ike_prop; pre-shared-key ascii-text “$7#$AAtBRmNOjH”; ##SECRET-DATA } } } Note: Juniper recommends implementing all Layer 3 services with the next-hop-style service set as opposed to the interface-style. When you configure next-hop-style service sets, you associate them with specific inside and outside logical interfaces. These logical interfaces are units you configure on an AS PIC’s sp- interface as illustrated below: interfaces { sp-0/0/0 { unit 0 { family inet; } unit 1 { description "IPSec Tunnel Inside Service Interface"; family inet; service-domain inside; } unit 2 { description "IPSec Tunnel Outside Service Interface"; family inet; service-domain outside; } } … … } The router must be configured to match the traffic that is to be secured in the outbound direction. For next-hop service sets, this is the input direction as configured via match-direction input command as shown above under the services ipsec-vpn hierarchy. You configure the router to route traffic to the inside or outside interface as shown in the following example: routing-options { static { route 10.2.2.0/24 next-hop sp-0/0/0.1; } }

Fix: F-17752r1_fix

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

a

Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network.

Low - V-17836 - SV-19314r1_rule

RMF Control

Severity

L

CCI

Version

NET1007

Vuln IDs

V-17836

Rule IDs

SV-19314r1_rule

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic. System AdministratorInformation Assurance Officer

Checks: C-20263r1_chk

Review the configuration of the MLS or router to determine if the management traffic is classified and marked to a favorable PHB at the distribution layer. According to the DISN approved QoS classifications, control plane and management plane traffic should use DSCP 48 (Network-Control PHB). In the example configurations below, an infrastructure router within the managed network’s distribution layer will classify and mark at ingress all traffic destined to management network with DSCP 48. firewall { family inet { filter set-FC-to-network-control { term match-management-network-prefix { from { destination-address { 10.10.10.0/24; } } then { forwarding-class network-control; accept; } } term accept-all { then accept; } } } } interfaces { fe-0/0/2 { description “link to LAN1” unit 0 { family inet { filter { input set-FC-to-network-control; } address 192.168.1.1/24; } } } fe-0/0/2 { description “link to LAN2” unit 0 { family inet { filter { input set-FC-to-network-control; } address 192.168.2.1/24; } } } ge-0/0/1 { description “link to core” unit 0 { family inet { address 192.168.2.1/24; } } } } By default, rewrite rules are not applied to interfaces. Without rewriting the DSCP value in the packet, the packet will be transmitted with the original value prior to classifying by the local router. To apply a rewrite rule, you can either use the default rules or design new rules. In either case, you must apply the rules to the outgoing interface under the class-of-service hierarchy as shown in the following configuration: class-of-service { interfaces { ge-0/0/1 { unit 0 { rewrite-rules { dscp default; } } } } }

Fix: F-17756r1_fix

When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.

a

The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network.

Low - V-17837 - SV-19316r1_rule

RMF Control

Severity

L

CCI

Version

NET1008

Vuln IDs

V-17837

Rule IDs

SV-19316r1_rule

When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed. When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic. System AdministratorInformation Assurance Officer

Checks: C-20265r1_chk

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network. Step 1: Verify that all internal or core router interfaces are bound to a DSCP classifier and that both CE-facing and core-facing interfaces have a forwarding-class policy defined (i.e. scheduler-map) as shown in the configuration below: class-of-service { interfaces { fe-* { scheduler-map MAP-FC-Policy; unit 0 { classifiers { dscp access-classifier; } rewrite-rules { dscp basic-rewrite-rules; } } } ge-* { scheduler-map MAP-FC-Policy; unit 0 { classifiers { dscp core-classifier; } } } } } Step 2: Verify that the classifier places traffic in the appropriate forwarding class according to the approved DSCPs as shown in the example below: class-of-service { classifiers { dscp access-classifier { forwarding-class best-effort { loss-priority high code-points 000000; } forwarding-class data-AF13-AF23 { loss-priority high code-points 001110; loss-priority low code-points 010110; } forwarding-class video-AF33-AF43 { loss-priority high code-points 011110; loss-priority low code-points 100110; } forwarding-class voice-EF { loss-priority low code-points 101110; } forwarding-class network-control { loss-priority low code-points 110000; } } } } Step 3: Verify that the forwarding classes are associated with the correct queues and polices (i.e., schedulers) as shown in the example below: class-of-service { forwarding-classes { queue 0 best-effort; queue 1 data-AF13-AF23; queue 2 video-AF33-AF43; queue 3 voice-EF; queue 4 network-control; } scheduler-maps { MAP-FC-Policy { forwarding-class best-effort scheduler Q0-best-effort; forwarding-class data-AF13-AF23 scheduler Q1-data; forwarding-class video-AF33-AF43 scheduler Q2-video; forwarding-class voice-EF scheduler Q3-voice; forwarding-class network-control scheduler Q4-network-control; } schedulers { Q0-best-effort { transmit-rate percent 20; buffer-size percent 20; drop-profile-map loss-priority low protocol any drop-profile be-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile be-high-drop-profile; priority low; } Q1-data { transmit-rate percent 35; buffer-size percent 30; drop-profile-map loss-priority low protocol any drop-profile data-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile data-high-drop-profile; priority low; } Q2-video { transmit-rate percent 40; buffer-size percent 35; drop-profile-map loss-priority low protocol any drop-profile video-low-drop-profile; drop-profile-map loss-priority high protocol any drop-profile video-high-drop-profile; priority low; } Q3-voice { buffer-size percent 10; priority strict-high; } Q4-network-control { transmit-rate percent 5; buffer-size percent 5; priority high; } } drop-profiles { video -high-drop-profile { fill-level 30 drop-probability 30; fill-level 50 drop-probability 50; fill-level 70 drop-probability 60; fill-level 90 drop-probability 100; } video -low-drop-profile { fill-level 40 drop-probability 30; fill-level 60 drop-probability 50; fill-level 80 drop-probability 60; fill-level 100 drop-probability 100; } data-high-drop-profile { fill-level 25 drop-probability 30; fill-level 45 drop-probability 50; fill-level 65 drop-probability 60; fill-level 85 drop-probability 100; } data-low-drop-profile { fill-level 30 drop-probability 30; fill-level 50 drop-probability 50; fill-level 70 drop-probability 60; fill-level 90 drop-probability 100; } be-high-drop-profile { fill-level 20 drop-probability 30; fill-level 40 drop-probability 50; fill-level 60 drop-probability 60; fill-level 80 drop-probability 100; } be-low-drop-profile { fill-level 25 drop-probability 30; fill-level 45 drop-probability 50; fill-level 65 drop-probability 60; fill-level 85 drop-probability 100; } } } Note: Scheduling policy maps configure the forwarding classes that represent packet queues for the physical interfaces that they are bound to. On M-series and T-series platforms, you can configure one queue per interface to have strict-high priority, which works the same as high priority, but provides unlimited transmission bandwidth. Hence, there is no need to define a transmit-rate for a strict-high priority queue. As long as the queue with strict-high priority has traffic to send, it receives precedence over all other queues, except queues with high priority. Queues with strict-high and high priority take turns transmitting packets until the strict-high queue is empty, the high priority queues are empty, or the high priority queues run out of bandwidth credit. Only then can lower priority queues send traffic. If only 4 queues are supported by the interface, map two classes into one queue as shown in the following example: class-of-service { restricted-queues { forwarding-class best-effort queue 0; forwarding-class data-AF13-AF23 queue 0; forwarding-class video-AF33-AF4 queue 1; forwarding-class voice-EF 2; forwarding-class network-control queue 3; } }

Fix: F-17757r1_fix

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic.

b

Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Medium - V-18522 - SV-20061r2_rule

RMF Control

Severity

M

CCI

Version

NET-SRVFRM-003

Vuln IDs

V-18522

Rule IDs

SV-20061r2_rule

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.Information Assurance OfficerECSC-1

Checks: C-21297r5_chk

Review the device configuration to validate an ACL with a deny-by-default security posture has been implemented on the server VLAN interface.

Fix: F-19125r4_fix

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

b

Default routes must not be directed to the tunnel entry point.

Medium - V-18790 - SV-20504r2_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-012

Vuln IDs

V-18790

Rule IDs

SV-20504r2_rule

Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface. If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.Information Assurance OfficerECSC-1

Checks: C-22501r1_chk

Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route. Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.

Fix: F-19446r1_fix

The SA must carefully plan and configure or let IGP determine what goes into each tunnel.

b

Control plane protection is not enabled.

Medium - V-19188 - SV-21168r2_rule

RMF Control

Severity

M

CCI

Version

NET0966

Vuln IDs

V-19188

Rule IDs

SV-21168r2_rule

The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages. In addition to control plane and management plane traffic that is in the router’s receive path, the RP must also handle other traffic that must be punted to the RP—that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic. Using the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch. System AdministratorInformation Assurance Officer

Checks: C-23286r3_chk

There are numerous rate limiters built into both the Packet Forwarding Engine and the RE to manage exception traffic to and from the RE. Traffic destined to the system is prioritized upon receipt based on protocol in the PFE (forwarding plane). Legitimate traffic bound for the RE is throttled and queued based on protocol priority and appropriately scheduled for transmission across the PFE to RE interface. Juniper is unique. For the most part, ICMP processing is processed by the PFE. This is especially helpful for packets with a next-hop of discard. The forwarding board generates the ICMP unreachable, not the routing engine. These mechanisms aren't configurable and have always been part of the Juniper M/T series architecture. In addition, Juniper handles fragmentation in the data plane, not the RE. Step 1: Verify that an inbound filter has been applied to the loopback interface to restrict traffic destined to the router. The interface configuration should look similar to the following: interfaces { lo0 { unit 0 { family inet { no-redirects; filter { input router-protect-filter; } address 10.10.2.1/32 } } } } Step 2: Verify the filter bound to the router’s loopback address restricts all control plane and management plane traffic. The filter configuration should look similar to the following: firewall { filter router-protect-filter { /* police management and ICMP traffic */ policer mgmt-128k { if-exceeding { bandwidth-limit 128k; burst-size-limit 2k; } then discard; } policer mgmt-64k { if-exceeding { bandwidth-limit 64k; burst-size-limit 1k; } then discard; } policer icmp-64k { if-exceeding { bandwidth-limit 64k; burst-size-limit 1k; } then discard; } /* drop framgmented ICMP messages */ term fragmented-icmp { from { protocol icmp; is-fragment; } then { syslog; discard; } } /* allow specific management plane traffic */ term ssh-access { from { source-address { 192.168.1.0/24; } protocol tcp; destination-port ssh; } then { policer mgmt-64k; accept; } } term snmp-access { from { source-address { 192.168.1.22/32; 192.168.1.24/32; } protocol udp; destination-port snmp; } then { policer mgmt-128k; accept; } } term tacacs-access { from { source-address { 192.168.1.101/32; } protocol tcp; port tacacs-ds; } then { policer mgmt-64k; accept; } } term ntp-access { from { source-address { 192.168.1.70/32; 192.168.1.77/32; } protocol udp; port ntp; } then { policer mgmt-64k; accept; } } term allow-ICMP { from { source-address { 192.168.1.0/24; } protocol icmp; } then { policer icmp-64k; accept; } } /* allow specific control plane traffic */ term guard-bgp { from { source-address { 199.21.32.11/32; 199.21.32.12/32; } protocol tcp; port bgp; } then { syslog; accept; } } term guard-ospf { from { source-address { 199.21.32.11/32; 199.21.32.12/32; } protocol ospf; } then { syslog; accept; } } … … … term default-action { then { syslog; discard; } } } }

Fix: F-19812r1_fix

Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.

a

Long Name: The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic.

Low - V-19189 - SV-21170r1_rule

RMF Control

Severity

L

CCI

Version

NET-MCAST-010

Vuln IDs

V-19189

Rule IDs

SV-21170r1_rule

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.System AdministratorInformation Assurance Officer

Checks: C-23288r1_chk

The following examples will establish a multicast boundary on the interface to ensure that Local-scope IPv4 traffic or Site-local scope IPv6 traffic is not allowed into or out of the administratively scoped multicast region. You can configure multicast scoping with a scope statement or with a scope-policy statement as shown in the examples. Example using the scope statement routing-options { multicast { scope ipv4-administrative-scope { interface [fe-1/1/1 fe-1/1/2]; prefix 239.255.0.0/16; } scope ipv6-administrative-scope { interface [fe-1/1/1 fe-1/1/2]; prefix FF05::/16; } } } Example using the scope-policy statement routing-options { multicast { scope-policy block-admin-scope; } } . . . policy-options { policy-statement block-admin-scope { term reject-i { from { route-filter 239.255.0.0/16 orlonger; route-filter FF08::/16 orlonger; } then reject; } } }

Fix: F-19813r1_fix

Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.

a

The network element must use two or more NTP servers to synchronize time.

Low - V-23747 - SV-41498r1_rule

RMF Control

Severity

L

CCI

Version

NET0812

Vuln IDs

V-23747

Rule IDs

SV-41498r1_rule

Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.System AdministratorInformation Assurance Officer

Checks: C-12792r2_chk

Review the router or switch configurations and verify that two or more NTP servers have been defined similar to the following example: [edit system] ntp { boot-server 129.237.32.2; server 129.237.32.2; server 142.181.31.6; } Note: The boot-server statement identifies the server from which the initial time of day and date is obtained when the router boots. The server statements identify the NTP servers used for periodic time synchronization.

Fix: F-3044r2_fix

Configure the device to use two separate NTP servers.

b

A service or feature that calls home to the vendor must be disabled.

Medium - V-28784 - SV-36774r5_rule

RMF Control

Severity

M

CCI

Version

NET0405

Vuln IDs

V-28784

Rule IDs

SV-36774r5_rule

Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security Officer

Checks: C-35853r4_chk

Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

Fix: F-31103r2_fix

Configure the network device to disable the call home service or feature. Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

b

The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.

Medium - V-30577 - SV-40313r1_rule

RMF Control

Severity

M

CCI

Version

NET-MCAST-001

Vuln IDs

V-30577

Rule IDs

SV-40313r1_rule

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.System Administrator

Checks: C-39165r1_chk

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM. Review the interfaces that have been defined under the protocols PIM hierarchy and verify that they all need to support multicast routing. When using the explicit interface declarations, the configuration would look similar to the following: protocols { pim { interface so-7/0/1.0 { mode sparse; version 2; } interfaces ge-0/3/0.0 { mode sparse; version 2; } … … … } If the interface all statement is used, verify that interfaces not supporting multicast routing have PIM disabled using the disable keyword. The configuration would look similar to the following: protocols { pim { interface all { mode sparse; version 2; } interface fx0.0 { disable; } interfaces fe-1/1/1 { disable; } interfaces fe-1/1/2 { disable; } } }

Fix: F-34295r1_fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.

b

The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.

Medium - V-30578 - SV-40316r1_rule

RMF Control

Severity

M

CCI

Version

NET-MCAST-002

Vuln IDs

V-30578

Rule IDs

SV-40316r1_rule

Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.Information Assurance Officer

Checks: C-39169r1_chk

Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram. JUNOS does not have a PIM neighbor filter; Hence, a firewall filter will have to be used similar to the example shown below. Step 1: Verify that an input filter is configured that will specify the allowable PIM neighbors similar to the following example. firewall { filter input-filter { term pim-neighbors { from { source-address { 192.0.2.1/32; 192.0.2.3/32; } destination-address { 224.0.0.13/32; } protocol pim; } then accept; } term … Step 2: Verify that an input filter is applied to all PIM enabled interfaces. The configuration should look similar to the following: interfaces fe-1/1/1 { unit 0 { family inet { filter { input input-filter; } address 192.0.2.2/32; } } } To determine which interfaces are enabled for PIM, review the interface section within the protocols pim hierarchy that will look similar to the following example: protocols { … pim { interface all { mode sparse; } } }

Fix: F-34301r1_fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

a

The administrator must ensure that the maximum hop limit is at least 32.

Low - V-30617 - SV-40390r1_rule

RMF Control

Severity

L

CCI

Version

NET-IPV6-059

Vuln IDs

V-30617

Rule IDs

SV-40390r1_rule

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.Information Assurance Officer

Checks: C-39254r1_chk

Review the router or multi-layer switch configuration to determine if the default maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. protocols { … … router-advertisement { interface [fe-1/1/1 fe-1/1/2] { current-hop-limit 128; } … } } Note: The JUNOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.

Fix: F-34363r2_fix

Configure maximum hop limit to at least 32.

b

The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network.

Medium - V-30660 - SV-40455r1_rule

RMF Control

Severity

M

CCI

Version

NET-IPV6-065

Vuln IDs

V-30660

Rule IDs

SV-40455r1_rule

The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.Information Assurance Officer

Checks: C-39285r1_chk

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Fix: F-34388r1_fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.

a

The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

Low - V-30736 - SV-40541r1_rule

RMF Control

Severity

L

CCI

Version

NET-IPV6-066

Vuln IDs

V-30736

Rule IDs

SV-40541r1_rule

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router. Information Assurance Officer

Checks: C-39312r1_chk

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Fix: F-34421r1_fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

b

The administrator must ensure the that all L2TPv3 sessions are authenticated prior to transporting traffic.

Medium - V-30744 - SV-40557r1_rule

RMF Control

Severity

M

CCI

Version

NET-TUNL-034

Vuln IDs

V-30744

Rule IDs

SV-40557r1_rule

L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.Information Assurance Officer

Checks: C-39322r1_chk

Currently JUNOS does not support L2TPv3 so this vulnerability is not applicable.

Fix: F-34428r1_fix

Configure L2TPv3 to use authentication for any peering sessions.

b

The network element must authenticate all BGP peers within the same or between autonomous systems (AS).

Medium - V-31285 - SV-41556r2_rule

RMF Control

Severity

M

CCI

Version

NET0408

Vuln IDs

V-31285

Rule IDs

SV-41556r2_rule

As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet—including RST flags. One way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.

Checks: C-40050r1_chk

Review the router configuration to determine if authentication is being used for all peers. An authentication key should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example: protocols bgp { group external-peers { type external; neighbor 171.69.232.90 { peer-as 200; authentication-key xxxxx; } neighbor 171.69.232.100 { peer-as 300; authentication-key xxxxx; } } } Note: The authentication-key statement can be applied at the BGP level, at the group level, or at the neighbor level.

Fix: F-14123r2_fix

Configure the device to authenticate all BGP peers.

Removed rules 1

Content changes 9

Checks: C-12941r3_chk

Fix: F-3025r4_fix

Generate Mitigation Statement:

Checks: C-3837r1_chk

Fix: F-3033r1_fix

Generate Mitigation Statement:

Checks: C-3456r6_chk

Fix: F-3037r6_fix

Generate Mitigation Statement:

Checks: C-3474r10_chk

Fix: F-3038r8_fix

Generate Mitigation Statement:

Checks: C-12919r3_chk

Fix: F-3039r5_fix

Generate Mitigation Statement:

Checks: C-12797r2_chk

Fix: F-3045r2_fix

Generate Mitigation Statement:

Checks: C-12799r3_chk

Fix: F-3046r4_fix

Generate Mitigation Statement:

Checks: C-3489r4_chk

Fix: F-3059r3_fix

Generate Mitigation Statement:

Checks: C-3825r7_chk

Fix: F-3068r4_fix

Generate Mitigation Statement:

Checks: C-3503r11_chk

Fix: F-3081r9_fix

Generate Mitigation Statement:

Checks: C-12938r5_chk

Fix: F-3082r5_fix

Generate Mitigation Statement:

Checks: C-3505r5_chk

Fix: F-3083r5_fix

Generate Mitigation Statement:

Checks: C-39962r3_chk

Fix: F-40533r1_fix

Generate Mitigation Statement:

Checks: C-12917r6_chk

Fix: F-3094r5_fix

Generate Mitigation Statement:

Checks: C-12921r3_chk

Fix: F-3095r3_fix

Generate Mitigation Statement:

Checks: C-12702r2_chk

Fix: F-3104r4_fix

Generate Mitigation Statement:

Checks: C-12783r2_chk

Fix: F-3106r2_fix

Generate Mitigation Statement:

Checks: C-39968r2_chk

Fix: F-3110r4_fix

Generate Mitigation Statement:

Checks: C-40236r3_chk

Fix: F-35391r3_fix

Generate Mitigation Statement:

Checks: C-12698r2_chk

Fix: F-3185r4_fix

Generate Mitigation Statement:

Checks: C-29085r4_chk

Fix: F-3200r3_fix

Generate Mitigation Statement:

Checks: C-3820r6_chk

Fix: F-3221r5_fix

Generate Mitigation Statement:

Checks: C-3822r7_chk

Fix: F-3235r4_fix

Generate Mitigation Statement:

Checks: C-12936r5_chk

Fix: F-3899r9_fix

Generate Mitigation Statement:

Checks: C-12910r2_chk

Fix: F-3900r4_fix

Generate Mitigation Statement:

Checks: C-12801r6_chk

Fix: F-3902r7_fix

Generate Mitigation Statement: