Cyber Trackr - Infrastructure Router Security Technical Implementation Guide Juniper

Warning: Incompatible Browser

Incompatible Browser Detected - Internet Explorer

This web site uses advanced JavaScript for several data processing functions. Internet Explorer has severe deficiencies in it's JavaScript engine. Please use a modern day browser, such as Chrome or Edge, in order to take full advantage of this web site.

V-3000 No Change

Findings ID:	NET1020	Rule ID:	SV-15475r3_rule	Severity:	low	CCI:

Discussion

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack, or identify a configuration mistake on the device.Information Assurance OfficerECAT-1, ECAT-2, ECSC-1

Checks

Review the network device interface ACLs to verify all deny statements are logged.

Either the syslog or log action command will satisfy this requirement.

JUNOS Example:
[edit firewall]
family inet {
filter NIPRNet-ingress {
term first-accept {
from {
}
then accept;
}
term last-accept {
from {
destination-address {
131.77.5.32/32;
131.77.5.61/32;
}
protocol tcp;
destination-port http;
}
then accept;
}
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Configure interface ACLs to log all deny statements.

V-3008 No Change

Findings ID:	NET1800	Rule ID:	SV-3008r1_rule	Severity:	medium	CCI:

Discussion

Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN technologies such as subscribing to MPLS Layer 2 and Layer 3 VPN services) or implementing a secured path with gateway-to-gateway IPsec tunnel. The tunnel mode ensures that the management traffic will be logically separated from any other traffic traversing the same path.Information Assurance Officer

Checks

Have the SA display the configuration settings that enable this feature.

Review the network topology diagram, and review VPN concentrators. Determine if tunnel mode is being used by reviewing the configuration. Examples:

In CISCO
Router(config)# crypto ipsec transform-set transform-set-name transform1
Router(cfg-crypto-tran)# mode tunnel

OR in Junos
edit security ipsec security-association sa-name] mode tunnel

Fix

Establish the VPN as a tunneled VPN.

Terminate the tunneled VPN outside of the firewall.

Ensure all host-to-host VPN are established between trusted known hosts.

V-3012 No Change

Findings ID:	NET0230	Rule ID:	SV-3012r4_rule	Severity:	high	CCI:

Discussion

Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to the user requesting access to the network or a network device. Authorization requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of user identities is accomplished through the use of passwords, tokens, biometrics, or in the case of multi-factor authentication, some combination thereof. Lack of authentication enables anyone to gain access to the network or possibly a network device providing opportunity for intruders to compromise resources within the network infrastructure.Information Assurance Officer

Checks

Review the network devices configuration to determine if administrative access to the device requires some form of authentication--at a minimum a password is required.

If passwords aren't used to administrative access to the device, this is a finding.

Fix

Configure the network devices so it will require a password to gain administrative access to the device.

V-3013 Updated

Findings ID:	NET0340	Rule ID:	SV-3013r45_rule	Severity:	medium	CCI:

Discussion

All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized personnel that access to the device is subject to monitoring to detect unauthorized usage. Failure to display the required logon warning banner prior to logon attempts will limit DoD's ability to prosecute unauthorized access and also presents the potential to give rise to criminal and civil liability for systems administrators and information systems managers. In addition, DISA's ability to monitor the device's usage is limited unless a proper warning banner is displayed.

DoD CIO has issued new, mandatory policy standardizing the wording of "notice and consent" banners and matching user agreements for all Secret and below DoD information systems, including stand-alone systems by releasing DoD CIO Memo, "Policy on Use of Department of Defense (DoD) Information Systems Standard Consent Banner and User Agreement", dated 9 May 2008. The banner is mandatory and deviations are not permitted except as authorized in writing by the Deputy Assistant Secretary of Defense for Information and Identity Assurance. Implementation of this banner verbiage is further directed to all DoD components for all DoD assets via USCYBERCOM CTO 08-008A.Information Assurance Officer

Checks

Review the device configuration or request that the administrator logon to the device and observe the terminal. Verify either Option A or Option B (for systems with character limitations) of the Standard Mandatory DoD Notice and Consent Banner is displayed at logon. The required banner verbiage follows and must be displayed verbatim:

Option A

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Option B

If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

If the device configuration does not have a logon banner as stated above, this is a finding.

Fix

Configure all management interfaces to the network device to display the DoD-mandated warning banner verbiage at logon regardless of the means of connection or communication. The required banner verbiage that must be displayed verbatim is as follows:

Option A

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations.

-At any time, the USG may inspect and seize data stored on this IS.

-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.

-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.

-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Option B

If the system is incapable of displaying the required banner verbiage due to its size, a smaller banner must be used. The mandatory verbiage follows: "I've read & consent to terms in IS user agreem't."

V-3014 No Change

Findings ID:	NET1639	Rule ID:	SV-15454r2_rule	Severity:	medium	CCI:

Discussion

Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example:

[edit system login]
class superuser-local {
idle-timeout 10;
permissions all;
}

Note: There is no default idle-timeout; hence, without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class.
When ssh is enabled, all users can use it to access the router---including the root account. This presents two problems:

1) The root account now be accessed using in-band management
2) Since the root account does not belong to a login class, there is no way to set the idle timeout.

Access to the root account via ssh must be disabled via root-login deny command. Following is an example configuration:

[edit system]
services {
ssh {
root-login deny;

Fix

Configure the network devices to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

V-3020 No Change

Findings ID:	NET0820	Rule ID:	SV-15331r2_rule	Severity:	low	CCI:

Discussion

The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.Information Assurance Officer

Checks

Review the active configuration to ensure that DNS servers have been defined similar to the following example:

[edit system]
name server {
192.168.1.253;
192.168.1.254;
}

Note: Since JUNOS will not send a DNS query to resolve names to IP addresses if a name server is not defined, this will never be a finding.

Fix

Configure the device to include DNS servers or disable domain lookup.

V-3021 No Change

Findings ID:	NET0890	Rule ID:	SV-15333r2_rule	Severity:	medium	CCI:

Discussion

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assurance Officer

Checks

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example:

snmp {
interface ge-0/1/0.0;
community xxxxxxxxx {
authorization read-only;
clients {
default restrict;
7.7.7.5/32;
}
}
}

Note: if the clients statement is not present, then all clients are allowed.

Fix

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

V-3034 No Change

Findings ID:	NET0400	Rule ID:	SV-15291r2_rule	Severity:	medium	CCI:

Discussion

A rogue router could send a fictitious routing update to convince a site’s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks.Information Assurance Officer

Checks

Fix

Configure authentication for all IGP peers.

V-3043 No Change

Findings ID:	NET1675	Rule ID:	SV-3043r4_rule	Severity:	medium	CCI:

Discussion

Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking experts. If a hacker gains access to these devices and can easily guess the name, this could result in denial of service, interception of sensitive information, or other destructive actions.Information Assurance Officer

Checks

Review the SNMP configuration of all managed nodes to ensure different community names (V1/2) or groups/users (V3) are configured for read-only and read-write access.

If unique community strings or accounts are not used for SNMP peers, this is a finding.

Fix

Configure the SNMP community strings on the network device and change them from the default values. SNMP community strings and user passwords must be unique and not match any other network device passwords. Different community strings (V1/2) or groups (V3) must be configured for various levels of read and write access.

V-3056 No Change

Findings ID:	NET0460	Rule ID:	SV-3056r7_rule	Severity:	high	CCI:

Discussion

Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance Officer

Checks

Review the network device configuration and validate there are no group accounts configured for access.

If a group account is configured on the device, this is a finding.

Fix

Configure individual user accounts for each authorized person then remove any group accounts.

V-3057 No Change

Findings ID:	NET0465	Rule ID:	SV-15472r4_rule	Severity:	medium	CCI:

Discussion

By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance Officer

Checks

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the least privilege level unless deemed necessary for assigned duties.

If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.

Below is an example configuration with three levels of authorization followed by account templates.

[edit system login]
class tier1 {
idle-timeout 15;
permissions [configure interface network routing snmp system trace view firewall ];
}
class tier2 {
idle-timeout 15;
permissions [admin clear configure interface network reset routing routing-control
snmp snmp-control system system-control trace trace-control view maintenance firewall
firewall-control secret rollback ];
}
class tier3 {
idle-timeout 15;
permissions all;
}

/* This is our local superuser account with a local password. */
user admin {
full-name Administrator;
uid 2000;
class tier3;
authentication {
encrypted-password xxxxxxx;
}
}

/* TACACS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
user tier3 {
uid 2003;
class tier3;
}

Using the example JUNOS configuration above and TACACS configuration below, when a user is using a template account, the CLI username is the login name; however, the privileges, file ownership, and effective user ID are inherited from the template account. The CLI username is sent to the authentication server with the correct password. The server returns the local username (i.e., “tier2”) to the JUNOS software as specified in the authentication server (local-user-name for TACACS+, Juniper-Local-User for RADIUS).

user = simon {
.
.
.
.
service = junos-exec {
local-user-name = tier2
allow-commands = "configure"
deny-commands = "shutdown"
}
}

'allow-commands' and 'deny-commands' override permissions of the class of the template that the local-user-name is associated with.

Fix

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

V-3058 No Change

Findings ID:	NET0470	Rule ID:	SV-3058r5_rule	Severity:	medium	CCI:

Discussion

A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service, interception of sensitive information, or other destructive actions could potentially take place if an unauthorized account is configured to access the network device.Information Assurance Officer

Checks

Review the organization's responsibilities list and reconcile the list of authorized accounts with those accounts defined for access to the network device.

If an unauthorized account is configured for access to the device, this is a finding.

Fix

Remove any account configured for access to the network device that is not defined in the organization's responsibilities list.

V-3062 No Change

Findings ID:	NET0600	Rule ID:	SV-41451r2_rule	Severity:	high	CCI:

Discussion

Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration.
Information Assurance OfficerECSC-1

Checks

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

Fix

For JUNOS, all passwords are always shown as encrypted. Hence, this would never be a finding.

V-3069 No Change

Findings ID:	NET1638	Rule ID:	SV-15452r4_rule	Severity:	medium	CCI:

Discussion

Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Checks

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols.

-SSHv2
-SCP
-HTTPS
-SSL
-TLS

JUNOS Example:
[edit system services]
ssh {
root-login (allow | deny | deny-password);
protocol-version [ v2 ];
macs [hmac-sha1 hmac-sha1-96];
ciphers [aes128-cbc aes192-cbc aes256-cbc];
}
[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
…
[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port ssh;
}
then {
syslog;
accept;
}
}
…
term default-action {
then {
syslog;
discard;
}
}
}
}

If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

Fix

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

V-3070 No Change

Findings ID:	NET1640	Rule ID:	SV-15456r2_rule	Severity:	low	CCI:

Discussion

Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance Officer

Checks

Review the router configurations and verify that all ssh connection attempts are logged. The configuration should look similar to the following:

[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}
[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port [ssh];
}
then {
syslog;
accept;
}
}
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

V-3079 No Change

Findings ID:	NET0730	Rule ID:	SV-15306r2_rule	Severity:	low	CCI:

Discussion

The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engineering practices to try to elicit classified DoD information.

Information Assurance Officer

Checks

Under the edit system services hierarchy, enter a show command to verify that the finger command is not present.

Fix

Configure the device to disable the Finger service.

V-3081 No Change

Findings ID:	NET0770	Rule ID:	SV-15317r2_rule	Severity:	medium	CCI:

Discussion

Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance Officer

Checks

Under the edit chassis hierarchy, enter a show command to verify that the no-source-route command is present.

Fix

Configure the router to disable IP source routing.

V-3085 No Change

Findings ID:	NET0740	Rule ID:	SV-41468r2_rule	Severity:	medium	CCI:

Discussion

The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software versions support remote configuration and monitoring using the World Wide Web's HTTP protocol. In general, HTTP access is equivalent to interactive access to the router. The authentication protocol used for HTTP is equivalent to sending a clear-text password across the network, and, unfortunately, there is no effective provision in HTTP for challenge-based or one-time passwords. This makes HTTP a relatively risky choice for use across the public Internet. Any additional services that are enabled increase the risk for an attack since the router will listen for these services. The HTTPS server may be enabled for administrative access.

Checks

Under the edit system services hierarchy enter a show command to verify the web-management http command is not present (the web-management https command may be enabled for administrative access). If you are reviewing an entire configuration, verify the web-management http command is not present as shown in the example below:

system {
services {
web-management {
http {
interface ge-0/0/0.0;
}
}
}
}

If the HTTP server is enabled, this is a finding.

Fix

Configure the device to disable using HTTP (port 80) for administrative access.

V-3143 No Change

Findings ID:	NET0240	Rule ID:	SV-3143r4_rule	Severity:	high	CCI:

Discussion

Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not removing them prior to deploying the network devices into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance Officer

Checks

Review the network devices configuration to determine if the vendor default password is active.

If any vendor default passwords are used on the device, this is a finding.

Fix

Remove any vendor default passwords from the network devices configuration.

V-3160 No Change

Findings ID:	NET0700	Rule ID:	SV-15303r2_rule	Severity:	medium	CCI:

Discussion

Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches, as well as enhancements to IP security. Viruses, denial of service attacks, system weaknesses, back doors and other potentially harmful situations could render a system vulnerable, allowing unauthorized access to DoD assets.Information Assurance Officer

Checks

In operational mode, have the router administrator execute the show version brief command to verify the installed JUNOS version. This command will show the base OS as well as the kernel, packet forwarding engine, routing, and crypto. Validate that all software components are at the required level.

J, M and T series should be 10.0 or later.

E series should be 10.2 or later

Verify that all IAVMs have been addressed.

Fix

Update operating system to a supported version that addresses all related IAVMs.

V-3175 No Change

Findings ID:	NET1636	Rule ID:	SV-28748r3_rule	Severity:	high	CCI:

Discussion

Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerECSC-1

Checks

Review the network device configuration to verify all management connections for administrative access require authentication.

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. Following is an example:

[edit system]
authentication-order [ radius password ];
radius-server {
192.168.6.5 {
secret "xxxxxxx";
}
}
login {
/* login classes */
class tier1 {
idle-timeout 10;
permissions all;
}
class tier2 {
idle-timeout 10;
permissions [ configure interface network routing snmp system trace view firewall ];
}
/* local emgergency account */
user admin {
full-name Administrator;
uid 2000;
class tier1;
authentication {
encrypted-password "xxxx"; # SECRET-DATA
}
}
/* RADIUS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
}

Note: When SSH is enabled, all users can use this service to access the router---including the root account. Access to the root account via SSH must be disabled via root-login deny command. Following is an example configuration:

[edit system]
services {
ssh {
root-login deny;

Fix

Configure authentication for all management connections.

V-3196 No Change

Findings ID:	NET1660	Rule ID:	SV-3196r4_rule	Severity:	high	CCI:

Discussion

SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network.Information Assurance Officer

Checks

Review the device configuration to verify it is configured to use SNMPv3 with both SHA authentication and privacy using AES encryption.

Downgrades:
If the site is using Version 1 or Version 2 with all of the appropriate patches and has developed a migration plan to implement the Version 3 Security Model, this finding can be downgraded to a Category II.

If the targeted asset is running SNMPv3 and does not support SHA or AES, but the device is configured to use MD5 authentication and DES or 3DES encryption, then the finding can be downgraded to a Category III.

If the site is using Version 1 or Version 2 and has installed all of the appropriate patches or upgrades to mitigate any known security vulnerabilities, this finding can be downgraded to a Category II. In addition, if the device does not support SNMPv3, this finding can be downgraded to a Category III provided all of the appropriate patches to mitigate any known security vulnerabilities have been applied and has developed a migration plan that includes the device upgrade to support Version 3 and the implementation of the Version 3 Security Model.

If the device is configured to use to anything other than SNMPv3 with at least SHA-1 and AES, this is a finding. Downgrades can be determined based on the criteria above.

Fix

If SNMP is enabled, configure the network device to use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography (i.e., SHA authentication and AES encryption).

V-3210 No Change

Findings ID:	NET1665	Rule ID:	SV-3210r4_rule	Severity:	high	CCI:

Discussion

Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance Officer

Checks

Review the network devices configuration and verify if either of the SNMP community strings "public" or "private" is being used.

If default or well-known community strings are used for SNMP, this is a finding.

Fix

Configure unique SNMP community strings replacing the default community strings.

V-3966 No Change

Findings ID:	NET0440	Rule ID:	SV-30085r5_rule	Severity:	medium	CCI:

Discussion

Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between the device and the authentication server is not operable. The console or local account of last resort logon credentials must be stored in a sealed envelope and kept in a safe.

Checks

Review the network device configuration to determine if an authentication server is defined for gaining administrative access. If so, there must be only one local account of last resort configured locally for an emergency.

Example:
[edit system]
class tier3 {
idle-timeout 15;
permissions all;
}
user admin {
full-name Administrator;
uid 2000;
class tier3;
authentication {
encrypted-password xxxxxxxxxxx;
}
}

Verify the username and password for the local account of last resort is contained within a sealed envelope kept in a safe.

If an authentication server is used and more than one local account exists, this is a finding.

Fix

Configure the device to only allow one local account of last resort for emergency access and store the credentials in a secure manner.

V-3967 No Change

Findings ID:	NET1624	Rule ID:	SV-15445r2_rule	Severity:	medium	CCI:

Discussion

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer

Checks

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class. The properties defined in a login class include user access privileges and the idle time permitted for a user login session. As shown in the example below, the idle time is specified with the idle-timeout specifying in minutes as to how long a session can be idle before it times out and the user is logged off. Check the classes that have been defined and examine the idle-timeout parameter. Following is an example:

[edit system login]
class superuser-local {
idle-timeout 10;
permissions all;
}

Notes:
1. There is no default idle-timeout. Without a timeout specified, a login session remains established until a user logs out of the router, even if that session is idle. Unlike IOS, to close idle sessions automatically, you must configure a time limit for each login class.
2. Since the root account does not belong to a class and you can access root via console, disable the ability to login using the root account by making the console insecure as follows:

[edit system]
console {
insecure;
}

Fix

Configure the timeout for idle console connection to 10 minutes or less.

V-3969 No Change

Findings ID:	NET0894	Rule ID:	SV-30087r3_rule	Severity:	medium	CCI:

Discussion

Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1

Checks

Review the network device configuration and verify SNMP community strings are read-only when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.

If write-access is used for SNMP versions 1, 2c, or 3-noAuthNoPriv mode and there is no documented approval by the IAO, this is a finding.

The SNMP V1 configuration should look similar to the following:

snmp {
interface ge-0/1/0.0;
community xxxxxxxxx {
authorization read-only;
clients {
default restrict;
7.7.7.5/30;
}
}

SNMPv3 access sets the SNMP access levels by context, group, and user. The context-name statement determines what management information is accessible by an SNMP entity. An SNMP entity can have access to many access contexts and therefore requires a name to identify each context. You must also associate a context with a specific access group and configure read and write views associated with each group. Specify the group-name variable to identify a collection of SNMP users that share the same access policy, in which object identifiers (OIDs) are read-accessible or write-accessible. Each group is the collection of users associated with the security model. You can only specify the model usm.

The example below as a “router context” which is accessed by two groups: NOC and engineers. NOC is only allowed read access while engineers have read and write access. John and Sue are users that belong to the engineers group and have authentication configured.

snmp {
view all {
oid .1.3.6.1 include;
}
engine-id {
local "isp-routers-0001";
}
access {
user john {
authentication-type md5;
authentication-password "john-auth-password";
privacy-type des;
privacy-password "john-privacy-password";
}
user sue {
authentication-type md5;
authentication-password "sue-auth-password";
privacy-type des;
privacy-password "sue-privacy-password";
}
user hpov {
authentication-type md5;
authentication-password "hpov-auth-password";
privacy-type des;
privacy-password "hpov-privacy-password";
}
group engineers {
model usm;
user [john sue];
}
group noc {
model usm;
user hpov;
}

context router {
description “a router context”;
group noc {
model usm;
security-level privacy;
read-view all;
}
group engineers {
model usm;
security-level privacy;
read-view all;
write-view all;
}

}
}

Fix

Configure the network device to allow for read-only SNMP access when using SNMPv1, v2c, or basic v3 (no authentication or privacy). Write access may be used if authentication is configured when using SNMPv3.

V-4582 No Change

Findings ID:	NET1623	Rule ID:	SV-28747r3_rule	Severity:	high	CCI:

Discussion

Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerIAIA-1, IAIA-2

Checks

Review the network device's configuration and verify authentication is required for console access.

With the exception of root, all user access privileges to a Juniper router are defined in a class. All users who log in to the router must be in a login class. Hence, user access to the router is via login class as shown in the following example:

[edit system]
authentication-order [ radius password ];
radius-server {
192.168.6.5 {
secret "xxxxxxx";
}
}
login {
/* login classes */
class tier1 {
idle-timeout 10;
permissions all;
}
class tier2 {
idle-timeout 10;
permissions [ configure interface network routing snmp system trace view firewall ];
}
/* local emgergency account */
user admin {
full-name Administrator;
uid 2000;
class tier1;
authentication {
encrypted-password "xxxx"; # SECRET-DATA
}
}
/* RADIUS templates */
user tier1 {
uid 2001;
class tier1;
}
user tier2 {
uid 2002;
class tier2;
}
}

Note: Since the root account does not belong to a class and you can access root via console, disable the ability to login at the console using the root account by making the console insecure as follows:

[edit system]
console {
insecure;
}

Fix

Configure authentication for console access on the network device.

V-4583 No Change

Findings ID:	NET0580	Rule ID:	SV-4583r1_rule	Severity:	low	CCI:

Discussion

If unauthorized users gain access to the routers diagnostic port, it is possible to disrupt service.Information Assurance Officer

Checks

IOS Procedure: N/A A Cisco router does not have a diagnostics port.

JUNOS Procedure: Review the router configuration to ensure a password is required when gaining access to the diagnostics port similar to the following:
[edit system]
diag-port-authentication {
encrypted-password "xxxxxxxxxxxxx"; # SECRET-DATA
}

Fix

The router administrator will ensure that a password is required to access the routers diagnostic port.

V-4584 No Change

Findings ID:	NET1021	Rule ID:	SV-15477r2_rule	Severity:	low	CCI:

Discussion

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.Information Assurance Officer

Checks

Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example:

[edit system syslog]
syslog {
host 192.168.1.22 {
any info;
facility-override local7;
}
}

The table below lists the severity levels and message types for all log data.

Severity
Level Message Type

0 Emergencies
1 Alerts
2 Critical
3 Errors
4 Warning
5 Notifications
6 Informational
7 Debugging

Fix

Configure the network device to log all messages except debugging and send all log data to a syslog server.

V-5611 No Change

Findings ID:	NET1637	Rule ID:	SV-15450r3_rule	Severity:	medium	CCI:

Discussion

Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Checks

Review the router configuration and verify that only authorized internal connections are allowed access to the routing engine via ssh. Access to the Juniper routing engine is via loopback interface. The configuration should look similar to the following:

[edit interfaces]
lo0 {
unit 0 {
family inet {
filter {
input protect-routing-engine;
}
address 192.168.1.2/32;
}
}
}

[edit firewall]
family inet {
filter protect-routing-engine {
term terminal-access {
from {
source-address {
192.168.1.10;
192.168.1.11;
}
protocol tcp;
port ssh;
}
then {
syslog;
accept;
}
}
term default-action {
then {
log;
discard;
}
}
}
}

Fix

Configure an ACL or filter to restrict management access to the device from only the management network.

V-5612 No Change

Findings ID:	NET1645	Rule ID:	SV-28744r2_rule	Severity:	medium	CCI:

Discussion

An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.Information Assurance Officer

Checks

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.

system {
login {
retry-options {
tries-before-disconnect 3;
maximum-time 60;
}

Fix

Configure the network devices so it will require a secure shell timeout of 60 seconds or less.

V-5613 No Change

Findings ID:	NET1646	Rule ID:	SV-28745r2_rule	Severity:	medium	CCI:

Discussion

An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer

Checks

Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.

system {
login {
retry-options {
tries-before-disconnect 3;
maximum-time 60;
}

Fix

Configure the network device to require a maximum number of unsuccessful SSH logon attempts at 3.

V-5646 No Change

Findings ID:	NET0965	Rule ID:	SV-15437r4_rule	Severity:	medium	CCI:

Discussion

A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator.

An attacker’s goal in this scenario is to cause a denial of service to the network or device by initiating a high volume of TCP packets, then never sending an acknowledgement, leaving connections in a half-opened state. Without the device having a connection or time threshold for these half-opened sessions, the device risks being a victim of a denial of service attack. Setting a TCP timeout threshold will instruct the device to shut down any incomplete connections. Services such as SSH, BGP, SNMP, LDP, etc. are some services that may be prone to these types of denial of service attacks. If the router does not have any BGP connections with BGP neighbors across WAN links, values could be set to even tighter constraints.Information Assurance OfficerECSC-1

Checks

Review the device configuration to validate threshold filters or timeout periods are set for dropping excessive half-open TCP connections.

For timeout periods, the time should be set to 10 seconds or less. If the device can not be configured for 10 seconds or less, it should be set to the least amount of time allowable in the configuration. Threshold filters will need to be determined by the organization for optimal filtering.

JUNOS Configuration Example:
firewall {
policer TCP-SYN-Policer {
if-exceeding {
bandwidth-limit 500k;
burst-size-limit 15k;
}
then discard;
}

family inet {
filter DOS-Protect {
.
.
.
/* Term tcp-syn-fin-limit: Rate limit TCP packets with SYN/FIN/RST flags. */
term tcp-syn-fin-limit {
from {
protocol tcp;
port [bgp ldp snmp snmptrap telnet ftp ftp-data ssh];
tcp-flags “syn | fin | rst”;
}
then policer TCP-SYN-Policer;
}
.
.
}

Fix

Configure the device to drop half-open TCP connections through threshold filtering or timeout periods.

V-7011 No Change

Findings ID:	NET1629	Rule ID:	SV-15447r2_rule	Severity:	low	CCI:

Discussion

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network.

Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.
Information Assurance Officer

Checks

Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.If the following configuration statements are found than a secure modem should be in place.

[edit system]
ports {
auxiliary {
type vt100;
}
}

Fix

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

V-14667 No Change

Findings ID:	NET0422	Rule ID:	SV-15301r4_rule	Severity:	low	CCI:

Discussion

If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.

Checks

Review device configuration for key expirations of 180 days or less.

If rotating keys are not configured to expire at 180 days or less, this is a finding.

Fix

Configure the device so rotating keys expire at 180 days or less.

V-14668 No Change

Findings ID:	NET0742	Rule ID:	SV-15312r1_rule	Severity:	medium	CCI:

Discussion

The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.Information Assurance Officer

Checks

Fix

Disable FTP server services on the device.

V-14669 No Change

Findings ID:	NET0744	Rule ID:	SV-15315r2_rule	Severity:	medium	CCI:

Discussion

Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a "trusted" machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methodsInformation Assurance Officer

Checks

Under the edit system services hierarchy, enter a show command to verify that the rlogin command is not present.

Fix

Configure the device to disable BSDr command services.

V-14670 No Change

Findings ID:	NET0802	Rule ID:	SV-15322r1_rule	Severity:	medium	CCI:

Discussion

The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly used by attackers for network mapping and diagnosis: Host unreachable, and Redirect.Information Assurance Officer

Checks

Fix

The network element configuration must be changed to ensure ICMPv6 unreachables and redirects are disabled at all external interfaces.

V-14671 No Change

Findings ID:	NET0813	Rule ID:	SV-41501r3_rule	Severity:	medium	CCI:

Discussion

Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source.

Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka "symmetric mode"). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client's stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers.

A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device loses connectivity to its upstream NTP server, it will be able to choose time from one of its peers.

The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It is not used to authenticate NTP clients because NTP servers do not care about the authenticity of their clients, as they never accept any time from them.

Checks

Review the network element configuration and verify that it is authenticating NTP messages received from the NTP server or peer using a FIPS-approved message authentication code algorithm. FIPS-approved algorithms for authentication are the cipher-based message authentication code (CMAC) and the keyed-hash message authentication code (HMAC). AES and 3DES are NIST-approved CMAC algorithms. The following are NIST-approved HMAC algorithms: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.

Downgrade:
If the network device is not capable of authenticating the NTP server or peer using a FIPS-approved message authentication code algorithm, then MD5 can be utilized for NTP message authentication and the finding can be downgraded to a CAT III.

If the network element is not configured to authenticate received NTP messages using a FIPS-approved message authentication code algorithm, this is a finding. A downgrade can be determined based on the criteria above.

Fix

Configure the device to authenticate all received NTP messages using a FIPS-approved message authentication code algorithm.

V-14672 No Change

Findings ID:	NET0897	Rule ID:	SV-16092r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TACACS+, RADIUS messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address when originating TACACS+ or RADIUS traffic. If the device is managed from an OOB management network, the OOB interface must be used instead.

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on JUNOS routers; however, multiple addresses can be defined.

Step 2: Verify that TACACS+ and RADIUS are configured to use the loopback address by comparing the source address defined for tacplus-server and radius-server with the address configured for the loopback interface. You should find a configuration similar to the examples below:

TACACS+

system {
tacplus-server {
10.10.2.11;
source-address 10.10.2.1;
}
}

RADIUS

system {
radius-server {
10.10.2.21;
source-address 10.10.2.1;
}
}

Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:

system {
default-address-selection;
…
}
}

Fix

Configure the device to use its loopback or OOB management interface address as the source address when originating authentication services traffic.

V-14673 No Change

Findings ID:	NET0898	Rule ID:	SV-15341r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Syslog messages sent to management servers should use the loopback address as the source address.Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address when originating syslog traffic. If the device is managed from an OOB management network, the OOB interface must be used instead

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Step 2: Verify that syslog is configured to use the loopback address by comparing the source address defined for syslog with the address configured for the loopback interface. You should find a configuration similar to the examples below:

system {
syslog {
host 192.168.1.100 {
any info;
}
source-address 192.168.1.1;
}
}

Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:

system {
default-address-selection;
…
}
}

Fix

Configure the device to use its loopback or OOB management interface address as the source address when originating syslog traffic.

V-14674 No Change

Findings ID:	NET0899	Rule ID:	SV-15344r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. NTP messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address when originating NTP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Step 2: Verify that NTP is configured to use the loopback address by comparing the source address defined for NTP with the address configured for the loopback interface. You should find a configuration similar to the examples below:

system {
ntp {
server 10.10.2.21;
source-address 10.10.2.1;
}
}

Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:

system {
default-address-selection;
…
}
}

Fix

Configure the device to use its loopback or OOB management interface address as the source address when originating NTP traffic.

V-14675 No Change

Findings ID:	NET0900	Rule ID:	SV-15347r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. SNMP messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address when originating SNMP traffic. If the device is managed from an OOB management network, the OOB interface must be used instead

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Step 2: Verify that SNMP is configured to use the loopback address by comparing the source address defined for SNMP with the address configured for the loopback interface. You should find a configuration similar to the examples below:

snmp {
clients {
default restrict;
10.10.2.111/32;
}
trap-options {
source-address 10.10.2.1;
}
}

Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:

system {
default-address-selection;
…
}
}

Fix

Configure the device to use its loopback or OOB management interface address as the source address when originating SNMP traffic.

V-14676 No Change

Findings ID:	NET0901	Rule ID:	SV-15350r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. Netflow messages sent to management servers should use the loopback address as the source address. Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address when originating Netflow traffic. If the device is managed from an OOB management network, the OOB interface must be used instead

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following.

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Step 2: Juniper has adopted the Cisco PDU format for flow export; However, Juniper does not call it NetFlow but "cflowd" and uses the flow export concept as a means to export packet-sampling data. Juniper has a filtering mechanism which allows you to sample packets and log them to the local file system or they can be exported using the "cflowd" forwarding options.
You should find a configuration similar to the example below depicting the source address for cflowd:

forwarding-options {
sampling {
input {
family inet {
rate 100;
run-length 4;
max-packets-per-second 5000;
}
}
output {
cflowd 10.10.2.22 {
port 9991;
source-address 10.10.2.1;
}
}
}

Note: If source-address is not specified, then the default-address-selection under system hierarchy must be configured. Configuring system default-address-selection will enable the router to use the loopback interface as the source address for most locally generated IP packets. This configuration would appear as follows:

system {
default-address-selection;
…
}
}

Fix

Configure the router to use its loopback or OOB management interface address as the source address when originating NetFlow traffic.

V-14677 No Change

Findings ID:	NET0902	Rule ID:	SV-15353r3_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network management subnet since the source addresses will be from the range used for loopback interfaces instead of a larger range of addresses used for physical interfaces. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses. TFTP and FTP messages sent to management servers should use the loopback address as the source address.Information Assurance OfficerECSC-1

Checks

Review the configuration and verify a loopback interface address is used as the source address when originating TFTP or FTP traffic.

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:

interfaces {
lo0 {
unit 0 {
family inet {
address x.x.x.x/32;
}
}
}

Step 2: There is no method to override the source address default for TFTP and FTP. Hence, the router must be configured to use the loopback as the default source address for all locally generated traffic. This is accomplished by configuring the default-address-selection statement as shown in the following example:

system {
default-address-selection;
…
}
}

If the device is managed from an OOB management network, the OOB interface must be used instead.

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Fix

Configure the network device to use a loopback or OOB management interface address as the source address when originating TFTP or FTP traffic.

V-14681 No Change

Findings ID:	NET0903	Rule ID:	SV-15360r2_rule	Severity:	low	CCI:

Discussion

Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog servers will record the router’s loopback address instead of the numerous physical interface addresses.Information Assurance Officer

Checks

Review the configuration and verify the loopback interface address is used as the source address for all iBGP peering.

Step 1: Verify that a loopback address has been configured with an IP address. The configuration should look similar to the following:

interfaces {
lo0 {
unit 0 {
family inet {
address 10.10.2.1/32;
}
}
}

Note: Only one loopback interface can be configured on Juniper routers; however, multiple addresses can be defined.

Step 2: The vulnerability does not require eBGP peering to use the loopback address. Hence, the BGP router only requires that the loopback address is used to peer with its iBGP neighbors. You should find a configuration similar to the example below:

protocols {
bgp {
group iBGP_111 {
type internal;
local-address 10.10.2.1;
export next-hop-self;
peer-as 111;
neighbor 10.10.2.2;
}
}
}

Fix

Configure the network device's loopback address as the source address for iBGP peering.

V-14693 No Change

Findings ID:	NET-IPV6-025	Rule ID:	SV-15397r2_rule	Severity:	medium	CCI:

Discussion

As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect network security through leaks, ambiguity and potential misrouting, as documented in section 2 of RFC3879. RFC3879 formally deprecates the IPv6 site-local unicast prefix defined in RFC3513, i.e., 1111111011 binary or FEC0::/10.Information Assurance OfficerECSC-1

Checks

Review the device configuration to ensure FEC0::/10 IP addresses are not defined.

If FEC0::/10 IP addresses are defined, this is a finding.

Fix

Configure the device using authorized IP addresses.

V-14707 No Change

Findings ID:	NET-IPV6-034	Rule ID:	SV-15430r1_rule	Severity:	medium	CCI:

Discussion

Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interface appear in the routing table and match the interface on which the packet was received. If the packet was received from one of the best reverse path routes, the packet is forwarded as normal. If there is no reverse path route on the same interface from which the packet was received, it might mean that the source address was modified. If Unicast RPF does not find a reverse path for the packet, the packet is dropped.

If internal nodes automatically configure an address based on a prefix from a bogus Router Advertisement a dangerous situation may exist. An internal host may contact an internal server which responds with a packet that could be routed outside of the network via default routing (because the routers do not recognize the destination address as an internal address).

To prevent this, filtering should be applied to network interfaces between internal host LANs and internal server LANs to insure that source addresses have valid prefixes.
Information Assurance Officer

Checks

Fix

The network element must be configured to ensure that an ACL is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.

V-14717 No Change

Findings ID:	NET1647	Rule ID:	SV-15461r2_rule	Severity:	medium	CCI:

Discussion

SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. Information Assurance Officer

Checks

If SSH is used for administrative access, then Version 2 must be configured as shown in the following example:

system {
services {
ssh {
protocol-version v2;
}
}
}

Fix

Configure the network device to use SSH version 2.

V-15288 No Change

Findings ID:	NET-TUNL-017	Rule ID:	SV-16067r2_rule	Severity:	medium	CCI:

Discussion

ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISATAP is a service versus a product, and is readily available to most users. If a user knows the ISATAP router IP address, they can essentially get onto the IPv6 intranet. To control the vulnerability of this tunnel mechanism, it is critical to control the use of protocol 41 and use IPv4 filters to control what IPv4 nodes can send protocol 41 packets to an ISATAP router interface. Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms, such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets between sites within an enclave, not between enclaves.Information Assurance OfficerECSC-1

Checks

Verify ISATAP tunnels are terminated on the infrastructure routers or L3 switches within the enclave.

Fix

Terminate ISATAP tunnels at the infrastructure router to prohibit tunneled traffic from exiting the enclave perimeter prior to inspection by the IDS, IPS, or firewall.

V-15432 No Change

Findings ID:	NET0433	Rule ID:	SV-16259r4_rule	Severity:	medium	CCI:

Discussion

The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ or RADIUS, the administrators can easily add or remove user accounts, add or remove command authorizations, and maintain a log of user activity.

The use of an authentication server provides the capability to assign router administrators to tiered groups that contain their privilege level that is used for authorization of specific commands. For example, user mode would be authorized for all authenticated administrators while configuration or edit mode should only be granted to those administrators that are permitted to implement router configuration changes.Information Assurance Officer

Checks

Verify an authentication server is required to access the device and that there are two or more authentication servers defined.

If the device is not configured for two separate authentication servers, this is a finding.

Fix

Configure the device to use two separate authentication servers.

V-15434 No Change

Findings ID:	NET0441	Rule ID:	SV-16261r5_rule	Severity:	high	CCI:

Discussion

The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate authorization level to perform necessary administrative functions during this time.Information Assurance Officer

Checks

Review the emergency administration account configured on the network devices and verify that it has been assigned to a privilege level that will enable the administrator to perform necessary administrative functions when the authentication server is not online.

If the emergency administration account is configured for more access than needed to troubleshoot issues, this is a finding.

Fix

Assign a privilege level to the emergency administration account to allow the administrator to perform necessary administrative functions when the authentication server is not online.

V-17754 No Change

Findings ID:	NET1807	Rule ID:	SV-18945r2_rule	Severity:	medium	CCI:

Discussion

The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling network management traffic to flow between the managed NEs and the NOC. This allows the use of paths separate from those used by the network being managed. Traffic from the managed network to the management network and vice-versa must be secured via IPSec encapsulation.Information Assurance Officer

Checks

Review the device configuration to determine if IPSec tunnels used in transiting management traffic are filtered to only accept authorized traffic based on source and destination IP addresses of the management network.

If filters are not restricting only authorized management traffic into the IPSec tunnel, this is a finding.

Fix

Configure filters based on source and destination IP address to restrict only authorized management traffic into IPSec tunnels used for transiting management data.

V-17814 No Change

Findings ID:	NET1808	Rule ID:	SV-19063r1_rule	Severity:	medium	CCI:

Discussion

The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list used to identify the traffic to be protected must be a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.System AdministratorInformation Assurance Officer

Checks

Verify the configuration at the remote VPN end-point is a mirror configuration as that reviewed for the local end-point.

Fix

Configure he crypto access-list used to identify the traffic to be protected so that it is a mirror (both IP source and destination address) of the crypto access list configured at the remote VPN peer.

V-17815 No Change

Findings ID:	NET0985	Rule ID:	SV-19298r1_rule	Severity:	medium	CCI:

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. System Administrator

Checks

Verify that the OOBM interface is an adjacency only in the IGP routing domain for the management network. The following would be an example where RIP is run on the management network 10.0.0.0 and OSPF in the managed network 172.20.0.0. The network 10.1.20.0/24 is the OOBM backbone and 10.1.1.0 is the local management LAN connecting to the OOBM interfaces of the managed network (i.e., the private and service network) elements.
interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “Enclave Management LAN”
unit 0 {
family inet {
address 10.1.1.1/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
address 10.1.20.3/24;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
interface lo0.0;
}
}
rip {
group rip-neighbor {
neighbor t3-3/0/3.0;
export rip-advertisements;
}
}
}
policy-options {
policy-statement rip-advertisements {
from protocol rip;
then accept;
}
}
policy-statement direct-management-LAN {
from {
protocol direct;
interface [ lo0.0 t3-3/0/3.0 fe-0/0/2 ];
}
then accept;
}
}

Note: When you enable RIP, the default JUNOS behavior is to accept all learned RIP routes but export no routes to RIP neighbors. To have RIP send routing information to its neighbors, you need to configure a routing policy that has RIP export routes to its neighbors. In the example above, the OOBM gateway router will only have a RIP neighbor adjacency with its upstream OOB backbone router. However, it will advertise to the RIP domain the local management address prefix and the loopback address which also belongs to the management network.

Fix

Ensure that multiple IGP instances configured on the OOBM gateway router peer only with their appropriate routing domain. Verify that the all interfaces are configured for the appropriate IGP instance.

V-17816 No Change

Findings ID:	NET0986	Rule ID:	SV-19300r1_rule	Severity:	medium	CCI:

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains, separate IGP routing instances must be configured on the router—one for the managed network and one for the OOBM network. In addition, the routes from the two domains must not be redistributed to each other. System AdministratorInformation Assurance Officer

Checks

Verify that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.

There is no equivalent redistribute command in JUNOS. All redistribution of routes between protocols is done through the creation of a routing policy through the use of import and export statements. Verify that there are no export and policy-statement commands configured that would distribute routes from the IGP routing domain for the management network into the IGP routing domain of the managed network, or vice-versa. The following example illustrates how RIP routes would be redistributing into OSPF.

policy-options {
policy-statement rip-to-ospf {
from protocol rip;
then accept;
}
}
}
protocols {
ospf {
export rip-to-ospf;
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
}
}

As an alternative, static routes can be used to forward management traffic to the OOBM interface; however, this method may not scale well.

If static routes are used to forward management traffic to the OOB backbone network, verify that the OOBM interface is not an IGP adjacency and that the correct destination prefix has been configured to forward the management traffic to the correct next-hop and interface for the static route. In the following configuration examples, 10.1.1.0/24 is the management network and 10.1.20.4 is the interface address of the OOB backbone router that the OOB gateway router connects to. The network 10.1.20.0/24 is the OOBM backbone.

interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
address 10.1.20.3/24;
}
}
}

protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
interface lo0.0;
}
}

routing-options {
static {
route 10.1.1.0/24 {
next-hop 10.1.20.4;
}
}
}

Fix

Ensure that the IGP instance used for the managed network does not redistribute routes into the IGP instance used for the management network and vice versa.

V-17817 No Change

Findings ID:	NET0987	Rule ID:	SV-19302r2_rule	Severity:	medium	CCI:

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.System AdministratorInformation Assurance Officer

Checks

Review the ACL or filters for the router’s receive path and verify that only traffic sourced from the management network is allowed to access the router. This would include both management and control plane traffic.

Step 1: Verify that an inbound filter has been applied to loopback interface. This filter is used to restrict all traffic to the router engine. The interface configuration should look similar to the following:
interfaces {
lo0 {
unit 0 {
family inet {
no-redirects;
filter {
input router-protect-filter;
}
address 10.1.3.41/32;
}
}
}
}

Note: the address block used for loopback addresses should be independent of the address space used for the management backbone, the NOC, or the local management subnet. Loopback address should be configured with /32 prefixes to enable proper route advertisements and optimum path reachability for both control plane and management plane traffic within the global management network.

Step 2: Determine the address block of the management network at the NOC. In the example configuration below, the 10.2.2.0/24 is the management network at the NOC.

Step 3: Verify that the ACL referenced by the ip receive acl statement restricts all management plane traffic to the validated network management address block at the NOC. Management traffic can include telnet, SSH, SNMP, TACACS, RADIUS, TFTP, TFTP, FTP, and ICMP. Control plane traffic from OOBM backbone neighbors should also be allowed to access the router. The filter configuration should look similar to the following:

firewall {
filter router-protect-filter {
term ospf-neighbors {
from {
source-address {
10.2.2.0/24;
}
protocol ospf;
}
then {
syslog;
accept;
}
}
term ssh-access {
from {
source-address {
10.2.2.0/24;
}
protocol tcp;
destination-port ssh;
}
then {
syslog;
accept;
}
}
term snmp-access {
from {
source-address {
10.2.2.24/32;
10.2.2.25/32;
}
protocol udp;
destination-port snmp;
}
then {
syslog;
accept;
}
}
term tacacs-access {
from {
source-address {
10.2.2.30/32;
}
protocol tcp;
port tacacs-ds;
}
then {
syslog;
accept;
}
}
term ftp-access {
from {
source-address {
10.2.2.77/32;
}
protocol tcp;
port [ftp ftp-data];
}
then {
syslog;
accept;
}
}
term allow-ICMP {
from {
source-address {
10.2.2.0/24;
}
protocol icmp;
}
then accept;
}
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface ingress ACLs.

V-17818 No Change

Findings ID:	NET0988	Rule ID:	SV-19304r1_rule	Severity:	medium	CCI:

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks. System AdministratorInformation Assurance Officer

Checks

Examine the egress filter on the OOBM interface of the gateway router to verify that only traffic sourced from the management address space is allowed to transit the OOBM backbone. In the example configurations below, the 10.1.1.0/24 is the management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.

interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
filter {
output OOBM-egress-filter;
}
address 10.1.20.3/24;
}
}
}
}
firewall {
filter OOBM-egress-filter {
term allow-mgmt {
from {
source-address {
10.1.1.0/24;
}
destination-address {
10.2.2.0/24;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Configure the OOBM gateway router interface ACLs to ensure traffic from the managed network does not leak into the management network.

V-17819 No Change

Findings ID:	NET0989	Rule ID:	SV-19306r1_rule	Severity:	medium	CCI:

Discussion

If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to block any traffic from the management network destined for the managed network’s production address spaces.System AdministratorInformation Assurance Officer

Checks

Examine the ingress filter on the OOBM interface of the gateway router to verify that traffic is only destined to the local management address space. In the example configurations below, the 10.1.1.0/24 is the local management network address space at the enclave or managed network and 10.2.2.0/24 is the management network address space at the NOC.

interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
address 10.1.1.2/24;
}
}
}
t3-3/0/3 {
description “link to OOBM Backbone”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.20.3/24;
}
}
}
firewall {
filter OOBM-ingress-filter {
term allow-mgmt {
from {
source-address {
10.2.2.0/24;
}
destination-address {
10.1.1.0/24;
}
}
then {
accept;
}
}
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Configure access control lists or filters to block any traffic from the management network destined for the managed network's production address spaces.

V-17821 No Change

Findings ID:	NET0991	Rule ID:	SV-20206r2_rule	Severity:	medium	CCI:

Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance Officer

Checks

After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify that the interface has been assigned an address from the local management address block. In this example, that is 10.1.1.0/24.

interfaces {
fxp0 {
description “link to OOBM access switch”
unit 0 {
family inet {
address 10.1.1.22/24;
}
}
}

Fix

Configure the OOB management interface with an IP address from the address space belonging to the OOBM network.

V-17822 No Change

Findings ID:	NET0992	Rule ID:	SV-20209r1_rule	Severity:	medium	CCI:

Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.

An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network
System AdministratorInformation Assurance Officer

Checks

Step 1: Verify that the managed interface has an inbound and outbound filter configured as shown in the following example:

interfaces {
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.1.22/24;
}
}
}

Step 2: Verify that the ingress filter blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. In the example the management network at the NOC is 10.2.2.0/24.

firewall {
filter OOBM-ingress-filter {
term allow-mgmt {
from {
source-address {
10.2.2.0/24;
}
destination-address {
10.1.1.22/32;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}

Step 3: Verify that the egress filter blocks any traffic exiting the management interface that was not originated by the managed elements . Verify that the destination address is the NOC address space.

firewall {
filter OOBM-egress-filter {
term allow-mgmt {
from {
source-address {
10.1.1.22/32;
}
destination-address {
10.2.2.0/24;
}
}
then {
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network device.

V-17823 No Change

Findings ID:	NET0993	Rule ID:	SV-19335r2_rule	Severity:	low	CCI:

Discussion

The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network.

An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so management traffic, both data plane and control plane, does not leak into the managed network and production traffic does not leak into the management network.
System AdministratorInformation Assurance Officer

Checks

If the managed network element is a layer 3 device, review the configuration to verify the management interface is configured as passive for the IGP instance for the managed network. With JUNOS, routing protocols are enabled on the interfaces by specifying the interface under the routing protocol hierarchy. The following configuration would be an example where OSPF is only enabled on all interfaces except the management interface:

interfaces {
fe-0/0/0 {
description “link to our Private Net”
unit 0 {
family inet {
address 172.20.4.2/24;
}
}
}
fe-0/0/1 {
description “link to our Service Net”
unit 0 {
family inet {
address 172.20.5.2/24;
}
}
}
fe-0/0/2 {
description “link to our Management LAN”
unit 0 {
family inet {
filter {
input OOBM-ingress-filter;
output OOBM-egress-filter;
}
address 10.1.1.22/24;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface fe-0/0/0.0;
interface fe-0/0/1.0;
}
}
}

Fix

Configure the management interface as passive for the IGP instance configured for the managed network. Depending on the platform and routing protocol, this may simply require that the interface or its IP address is not included in the IGP configuration.

V-17834 No Change

Findings ID:	NET1005	Rule ID:	SV-19309r1_rule	Severity:	medium	CCI:

Discussion

If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the same time it is defined as a unique VLAN. Inter-VLAN routing or the routing of traffic between nodes residing in different subnets requires a router or multi-layer switch (MLS). Access control lists must be used to enforce the boundaries between the management network and the network being managed. All physical and virtual (i.e. MLS SVI) routed interfaces must be configured with ACLs to prevent the leaking of unauthorized traffic from one network to the other. System AdministratorInformation Assurance Officer

Checks

Review the router configuration and verify that an inbound ACL has been configured for the management network sub-interface as illustrated in the following example configuration:

interfaces fe-1/1/1 {
vlan-tagging;
unit 10 {
family inet {
filter {
input ingress-mgmt-vlan-filter;
}
address 10.1.1.1/24;
}
}
}
firewall {
filter ingress-mgmt-vlan-filter {
term …

Fix

If a router is used to provide inter-VLAN routing, configure an inbound ACL for the management network sub-interface for the trunk link to block non-management traffic.

V-17835 No Change

Findings ID:	NET1006	Rule ID:	SV-19311r1_rule	Severity:	medium	CCI:

Discussion

Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity between the NOC and the managed networks’ premise routers would be enabled using either provisioned circuits or VPN technologies such as IPSec tunnels or MPLS VPN services. System AdministratorInformation Assurance Officer

Checks

Verify that all traffic from the managed network to the management network and vice-versa is secured via IPSec encapsulation. In the configuration examples, 10.2.2.0/24 is the management network at the NOC and 192.168.1.0/24 is address space used at the network being managed (i.e., the enclave). Example from a show services command with Juniper M or T series router with Adaptive Services PIC using next-hop style is as follows:

service-set vpn-to-NOC {
next-hop-service {
inside-service-interface sp-0/0/0.1;
outside-service-interface sp-0/0/0.2;
}
ipsec-vpn-options {
local-gateway 19.16.1.1;
}
ipsec-vpn-rules site-to-NOC;
}
ipsec-vpn {
rule site-to-NOC {
term mgmt-traffic {
}
destination-address {
10.2.2.0/24;
}
}
then
remote-gateway 19.16.2.1;
dynamic {
ike-policy main_mode_ike_policy;
ipsec-policy dynamic_ipsec_policy;
}
}
}
match-direction input;
}
ipsec {
proposal esp_sha1_ipsec_prop {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
}
policy dynamic_ipsec_policy {
perfect-forward-secrecy {
keys group2;
}
proposals esp_sha1_ipsec_prop;
}
}
ike {
proposal psk_sha1_3des_ike_prop {
authentication-method pre-shared-keys;
authentication-algorithm sha1;
encryption-algorithm 3des-cbc;
}
policy main_mode_ike_policy {
mode main;
proposals psk_sha1_3des_ike_prop;
pre-shared-key ascii-text “$7#$AAtBRmNOjH”; ##SECRET-DATA
}
}
}

Note: Juniper recommends implementing all Layer 3 services with the next-hop-style service set as opposed to the interface-style. When you configure next-hop-style service sets, you associate them with specific inside and outside logical interfaces. These logical interfaces are units you configure on an AS PIC’s sp- interface as illustrated below:

interfaces {
sp-0/0/0 {
unit 0 {
family inet;
}
unit 1 {
description "IPSec Tunnel Inside Service Interface";
family inet;
service-domain inside;
}
unit 2 {
description "IPSec Tunnel Outside Service Interface";
family inet;
service-domain outside;
}
}
…
…
}

The router must be configured to match the traffic that is to be secured in the outbound direction. For next-hop service sets, this is the input direction as configured via match-direction input command as shown above under the services ipsec-vpn hierarchy. You configure the router to route traffic to the inside or outside interface as shown in the following example:

routing-options {
static {
route 10.2.2.0/24 next-hop sp-0/0/0.1;
}
}

Fix

Where IPSec technology is deployed to connect the managed network to the NOC, it is imperative that the traffic entering the tunnels is restricted to only the authorized management packets based on destination address.

V-17836 No Change

Findings ID:	NET1007	Rule ID:	SV-19314r1_rule	Severity:	low	CCI:

Discussion

When network congestion occurs, all traffic has an equal chance of being dropped.
Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed.

When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.
System AdministratorInformation Assurance Officer

Checks

Review the configuration of the MLS or router to determine if the management traffic is classified and marked to a favorable PHB at the distribution layer. According to the DISN approved QoS classifications, control plane and management plane traffic should use DSCP 48 (Network-Control PHB). In the example configurations below, an infrastructure router within the managed network’s distribution layer will classify and mark at ingress all traffic destined to management network with DSCP 48.

firewall {
family inet {
filter set-FC-to-network-control {
term match-management-network-prefix {
from {
destination-address {
10.10.10.0/24;
}
}
then {
forwarding-class network-control;
accept;
}
}
term accept-all {
then accept;
}
}
}
}
interfaces {
fe-0/0/2 {
description “link to LAN1”
unit 0 {
family inet {
filter {
input set-FC-to-network-control;
}
address 192.168.1.1/24;
}
}
}
fe-0/0/2 {
description “link to LAN2”
unit 0 {
family inet {
filter {
input set-FC-to-network-control;
}
address 192.168.2.1/24;
}
}
}
ge-0/0/1 {
description “link to core”
unit 0 {
family inet {
address 192.168.2.1/24;
}
}
}
}

By default, rewrite rules are not applied to interfaces. Without rewriting the DSCP value in the packet, the packet will be transmitted with the original value prior to classifying by the local router. To apply a rewrite rule, you can either use the default rules or design new rules. In either case, you must apply the rules to the outgoing interface under the class-of-service hierarchy as shown in the following configuration:

class-of-service {
interfaces {
ge-0/0/1 {
unit 0 {
rewrite-rules {
dscp default;
}
}
}
}
}

Fix

When management traffic must traverse several nodes to reach the management network, classify and mark management traffic at the nearest upstream MLS or router.

V-17837 No Change

Findings ID:	NET1008	Rule ID:	SV-19316r1_rule	Severity:	low	CCI:

Discussion

When network congestion occurs, all traffic has an equal chance of being dropped.
Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. Quality of Service (QoS) provisioning categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment through congestion avoidance techniques. Implementing QoS within the network makes network performance more predictable and bandwidth utilization more effective. Most important, since the same bandwidth is being used to manage the network, it provides some assurance that there will be bandwidth available to troubleshoot outages and restore availability when needed.

When management traffic must traverse several nodes to reach the management network, management traffic should be classified and marked at the nearest upstream MLS or router. In addition, all core routers within the managed network must be configured to provide preferred treatment based on the QoS markings. This will ensure that management traffic receives preferred treatment (per-hop behavior) at each forwarding device along the path to the management network. traffic.
System AdministratorInformation Assurance Officer

Checks

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic. This will ensure that management traffic receives guaranteed bandwidth at each forwarding device along the path to the management network.

Step 1: Verify that all internal or core router interfaces are bound to a DSCP classifier and that both CE-facing and core-facing interfaces have a forwarding-class policy defined (i.e. scheduler-map) as shown in the configuration below:

class-of-service {
interfaces {
fe-* {
scheduler-map MAP-FC-Policy;
unit 0 {
classifiers {
dscp access-classifier;
}
rewrite-rules {
dscp basic-rewrite-rules;
}
}
}
ge-* {
scheduler-map MAP-FC-Policy;
unit 0 {
classifiers {
dscp core-classifier;
}
}
}
}
}

Step 2: Verify that the classifier places traffic in the appropriate forwarding class according to the approved DSCPs as shown in the example below:

class-of-service {
classifiers {
dscp access-classifier {
forwarding-class best-effort {
loss-priority high code-points 000000;
}
forwarding-class data-AF13-AF23 {
loss-priority high code-points 001110;
loss-priority low code-points 010110;
}
forwarding-class video-AF33-AF43 {
loss-priority high code-points 011110;
loss-priority low code-points 100110;
}
forwarding-class voice-EF {
loss-priority low code-points 101110;
}
forwarding-class network-control {
loss-priority low code-points 110000;
}
}
}
}

Step 3: Verify that the forwarding classes are associated with the correct queues and polices (i.e., schedulers) as shown in the example below:

class-of-service {
forwarding-classes {
queue 0 best-effort;
queue 1 data-AF13-AF23;
queue 2 video-AF33-AF43;
queue 3 voice-EF;
queue 4 network-control;
}
scheduler-maps {
MAP-FC-Policy {
forwarding-class best-effort scheduler Q0-best-effort;
forwarding-class data-AF13-AF23 scheduler Q1-data;
forwarding-class video-AF33-AF43 scheduler Q2-video;
forwarding-class voice-EF scheduler Q3-voice;
forwarding-class network-control scheduler Q4-network-control;
}
schedulers {
Q0-best-effort {
transmit-rate percent 20;
buffer-size percent 20;
drop-profile-map loss-priority low protocol any drop-profile be-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile be-high-drop-profile;
priority low;
}
Q1-data {
transmit-rate percent 35;
buffer-size percent 30;
drop-profile-map loss-priority low protocol any drop-profile data-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile data-high-drop-profile;
priority low;
}
Q2-video {
transmit-rate percent 40;
buffer-size percent 35;
drop-profile-map loss-priority low protocol any drop-profile video-low-drop-profile;
drop-profile-map loss-priority high protocol any drop-profile video-high-drop-profile;
priority low;
}
Q3-voice {
buffer-size percent 10;
priority strict-high;
}
Q4-network-control {
transmit-rate percent 5;
buffer-size percent 5;
priority high;
}
}
drop-profiles {
video -high-drop-profile {
fill-level 30 drop-probability 30;
fill-level 50 drop-probability 50;
fill-level 70 drop-probability 60;
fill-level 90 drop-probability 100;
}
video -low-drop-profile {
fill-level 40 drop-probability 30;
fill-level 60 drop-probability 50;
fill-level 80 drop-probability 60;
fill-level 100 drop-probability 100;
}
data-high-drop-profile {
fill-level 25 drop-probability 30;
fill-level 45 drop-probability 50;
fill-level 65 drop-probability 60;
fill-level 85 drop-probability 100;
}
data-low-drop-profile {
fill-level 30 drop-probability 30;
fill-level 50 drop-probability 50;
fill-level 70 drop-probability 60;
fill-level 90 drop-probability 100;
}
be-high-drop-profile {
fill-level 20 drop-probability 30;
fill-level 40 drop-probability 50;
fill-level 60 drop-probability 60;
fill-level 80 drop-probability 100;
}
be-low-drop-profile {
fill-level 25 drop-probability 30;
fill-level 45 drop-probability 50;
fill-level 65 drop-probability 60;
fill-level 85 drop-probability 100;
}
}
}

Note: Scheduling policy maps configure the forwarding classes that represent packet queues for the physical interfaces that they are bound to. On M-series and T-series platforms, you can configure one queue per interface to have strict-high priority, which works the same as high priority, but provides unlimited transmission bandwidth. Hence, there is no need to define a transmit-rate for a strict-high priority queue. As long as the queue with strict-high priority has traffic to send, it receives precedence over all other queues, except queues with high priority. Queues with strict-high and high priority take turns transmitting packets until the strict-high queue is empty, the high priority queues are empty, or the high priority queues run out of bandwidth credit. Only then can lower priority queues send traffic.

If only 4 queues are supported by the interface, map two classes into one queue as shown in the following example:

class-of-service {
restricted-queues {
forwarding-class best-effort queue 0;
forwarding-class data-AF13-AF23 queue 0;
forwarding-class video-AF33-AF4 queue 1;
forwarding-class voice-EF 2;
forwarding-class network-control queue 3;
}
}

Fix

When management traffic must traverse several nodes to reach the management network, ensure that all core routers within the managed network have been configured to provide preferred treatment for management traffic.

V-18522 No Change

Findings ID:	NET-SRVFRM-003	Rule ID:	SV-20061r3_rule	Severity:	medium	CCI:

Discussion

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.Information Assurance Officer

Checks

Review the firewall protecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server, then review the ACL configured for the VLAN on the L3 switch.

Fix

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

V-18790 No Change

Findings ID:	NET-TUNL-012	Rule ID:	SV-20504r2_rule	Severity:	medium	CCI:

Discussion

Routing in the network containing the tunnel entry point must be configured to direct the intended traffic into the tunnel. Depending on the router products used this may be done by creating routes to a tunnel by name, by address, or by interface.

If multiple tunnels are defined or IPv6 interfaces, you must be selective with static routes, policy based routing, or even let the interior gateway protocol (IGP) make the decision since a ipv4 or ipv6 address has been configured on the tunnel. The key is the administrator should carefully plan and configure or let the IGP determine what goes into each tunnel.Information Assurance OfficerECSC-1

Checks

Identify the tunnel endpoints, then review all routing devices to ensure the tunnel entry point is not used as a default route.

Traffic destined to the tunnel should be directed to the tunnel endpoint by static routes, policy based routing, or by the mechanics of the interior routing protocol, but not by default route statements.

Fix

The SA must carefully plan and configure or let IGP determine what goes into each tunnel.

V-19188 No Change

Findings ID:	NET0966	Rule ID:	SV-21168r2_rule	Severity:	medium	CCI:

Discussion

The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Hence, any disruption to the RP or the control and management planes can result in mission critical network outages.

In addition to control plane and management plane traffic that is in the router’s receive path, the RP must also handle other traffic that must be punted to the RP—that is, the traffic must be fast or process switched. This is the result of packets that must be fragmented, require an ICMP response (TTL expiration, unreachable, etc.) have IP options, etc. A DoS attack targeting the RP can be perpetrated either inadvertently or maliciously involving high rates of punted traffic resulting in excessive RP CPU and memory utilization. To maintain network stability, the router must be able to securely handle specific control plane and management plane traffic that is destined to it, as well as other punted traffic.

Using the ingress filter on forwarding interfaces is a method that has been used in the past to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing can be used to increase security of routers and multilayer switches by protecting the RP from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.

System AdministratorInformation Assurance Officer

Checks

There are numerous rate limiters built into both the Packet Forwarding Engine and the RE to manage exception traffic to and from the RE. Traffic destined to the system is prioritized upon receipt based on protocol in the PFE (forwarding plane). Legitimate traffic bound for the RE is throttled and queued based on protocol priority and appropriately scheduled for transmission across the PFE to RE interface. Juniper is unique. For the most part, ICMP processing is processed by the PFE. This is especially helpful for packets with a next-hop of discard. The forwarding board generates the ICMP unreachable, not the routing engine. These mechanisms aren't configurable and have always been part of the Juniper M/T series architecture. In addition, Juniper handles fragmentation in the data plane, not the RE.

Step 1: Verify that an inbound filter has been applied to the loopback interface to restrict traffic destined to the router. The interface configuration should look similar to the following:

interfaces {
lo0 {
unit 0 {
family inet {
no-redirects;
filter {
input router-protect-filter;
}
address 10.10.2.1/32
}
}
}
}

Step 2: Verify the filter bound to the router’s loopback address restricts all control plane and management plane traffic. The filter configuration should look similar to the following:

firewall {
filter router-protect-filter {
/* police management and ICMP traffic */
policer mgmt-128k {
if-exceeding {
bandwidth-limit 128k;
burst-size-limit 2k;
}
then discard;
}
policer mgmt-64k {
if-exceeding {
bandwidth-limit 64k;
burst-size-limit 1k;
}
then discard;
}
policer icmp-64k {
if-exceeding {
bandwidth-limit 64k;
burst-size-limit 1k;
}
then discard;
}

/* drop framgmented ICMP messages */
term fragmented-icmp {
from {
protocol icmp;
is-fragment;
}
then {
syslog;
discard;
}
}
/* allow specific management plane traffic */
term ssh-access {
from {
source-address {
192.168.1.0/24;
}
protocol tcp;
destination-port ssh;
}
then {
policer mgmt-64k;
accept;
}
}
term snmp-access {
from {
source-address {
192.168.1.22/32;
192.168.1.24/32;
}
protocol udp;
destination-port snmp;
}
then {
policer mgmt-128k;
accept;
}
}
term tacacs-access {
from {
source-address {
192.168.1.101/32;
}
protocol tcp;
port tacacs-ds;
}
then {
policer mgmt-64k;
accept;
}
}
term ntp-access {
from {
source-address {
192.168.1.70/32;
192.168.1.77/32;
}
protocol udp;
port ntp;
}
then {
policer mgmt-64k;
accept;
}
}
term allow-ICMP {
from {
source-address {
192.168.1.0/24;
}
protocol icmp;
}
then {
policer icmp-64k;
accept;
}
}
/* allow specific control plane traffic */
term guard-bgp {
from {
source-address {
199.21.32.11/32;
199.21.32.12/32;
}
protocol tcp;
port bgp;
}
then {
syslog;
accept;
}
}
term guard-ospf {
from {
source-address {
199.21.32.11/32;
199.21.32.12/32;
}
protocol ospf;
}
then {
syslog;
accept;
}
}
…
…
…
term default-action {
then {
syslog;
discard;
}
}
}
}

Fix

Implement control plane protection by classifying traffic types based on importance levels and configure filters to restrict and rate limit the traffic punted to the route processor as according to each class.

V-19189 No Change

Findings ID:	NET-MCAST-010	Rule ID:	SV-21170r1_rule	Severity:	low	CCI:

Discussion

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces."

Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.System AdministratorInformation Assurance Officer

Checks

The following examples will establish a multicast boundary on the interface to ensure that Local-scope IPv4 traffic or Site-local scope IPv6 traffic is not allowed into or out of the administratively scoped multicast region. You can configure multicast scoping with a scope statement or with a scope-policy statement as shown in the examples.

Example using the scope statement

routing-options {
multicast {
scope ipv4-administrative-scope {
interface [fe-1/1/1 fe-1/1/2];
prefix 239.255.0.0/16;
}
scope ipv6-administrative-scope {
interface [fe-1/1/1 fe-1/1/2];
prefix FF05::/16;
}
}
}

Example using the scope-policy statement

routing-options {
multicast {
scope-policy block-admin-scope;
}
}
.
.
.
policy-options {
policy-statement block-admin-scope {
term reject-i {
from {
route-filter 239.255.0.0/16 orlonger;
route-filter FF08::/16 orlonger;
}
then reject;
}
}
}

Fix

Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.

V-23747 No Change

Findings ID:	NET0812	Rule ID:	SV-41498r1_rule	Severity:	low	CCI:

Discussion

Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.System AdministratorInformation Assurance Officer

Checks

Review the router or switch configurations and verify that two or more NTP servers have been defined similar to the following example:

[edit system]
ntp {
boot-server 129.237.32.2;
server 129.237.32.2;
server 142.181.31.6;
}

Note: The boot-server statement identifies the server from which the initial time of day and date is obtained when the router boots. The server statements identify the NTP servers used for periodic time synchronization.

Fix

Configure the device to use two separate NTP servers.

V-28784 No Change

Findings ID:	NET0405	Rule ID:	SV-36774r5_rule	Severity:	medium	CCI:

Discussion

Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security Officer

Checks

Review the device configuration to determine if the call home service or feature is disabled on the device. If the call home service is enabled on the device, this is a finding.

Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

Fix

Configure the network device to disable the call home service or feature.

Note: This feature can be enabled if the communication is only to a server residing in the local area network or enclave.

V-30577 No Change

Findings ID:	NET-MCAST-001	Rule ID:	SV-40313r1_rule	Severity:	medium	CCI:

Discussion

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.System Administrator

Checks

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM.

Review the interfaces that have been defined under the protocols PIM hierarchy and verify that they all need to support multicast routing. When using the explicit interface declarations, the configuration would look similar to the following:

protocols {
pim {
interface so-7/0/1.0 {
mode sparse;
version 2;
}
interfaces ge-0/3/0.0 {
mode sparse;
version 2;
}
…
…
…
}

If the interface all statement is used, verify that interfaces not supporting multicast routing have PIM disabled using the disable keyword. The configuration would look similar to the following:

protocols {
pim {
interface all {
mode sparse;
version 2;
}
interface fx0.0 {
disable;
}
interfaces fe-1/1/1 {
disable;
}
interfaces fe-1/1/2 {
disable;
}
}
}

Fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.

V-30578 No Change

Findings ID:	NET-MCAST-002	Rule ID:	SV-40316r1_rule	Severity:	medium	CCI:

Discussion

Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.Information Assurance Officer

Checks

Review the router or multi-layer switch to determine if either IPv4 or IPv6 multicast routing is enabled. If either is enabled, verify that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram. JUNOS does not have a PIM neighbor filter; Hence, a firewall filter will have to be used similar to the example shown below.

Step 1: Verify that an input filter is configured that will specify the allowable PIM neighbors similar to the following example.

firewall {
filter input-filter {
term pim-neighbors {
from {
source-address {
192.0.2.1/32;
192.0.2.3/32;
}
destination-address {
224.0.0.13/32;
}
protocol pim;
}
then accept;
}
term …

Step 2: Verify that an input filter is applied to all PIM enabled interfaces. The configuration should look similar to the following:

interfaces fe-1/1/1 {
unit 0 {
family inet {
filter {
input input-filter;
}
address 192.0.2.2/32;
}
}
}

To determine which interfaces are enabled for PIM, review the interface section within the protocols pim hierarchy that will look similar to the following example:

protocols {
…
pim {
interface all {
mode sparse;
}
}
}

Fix

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

V-30617 No Change

Findings ID:	NET-IPV6-059	Rule ID:	SV-40390r1_rule	Severity:	low	CCI:

Discussion

The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to hop limit reaching zero before the packets sent by a host reached its destination.Information Assurance Officer

Checks

Review the router or multi-layer switch configuration to determine if the default maximum hop limit has been configured. If it has been configured, then it must be set to at least 32.

protocols {
…
…
router-advertisement {
interface [fe-1/1/1 fe-1/1/2] {
current-hop-limit 128;
}
…
}
}

Note: The JUNOS default is 64. Hence, if the hop limit is not configured, the router will be in compliance with the requirement.

Fix

Configure maximum hop limit to at least 32.

V-30660 No Change

Findings ID:	NET-IPV6-065	Rule ID:	SV-40455r1_rule	Severity:	medium	CCI:

Discussion

The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being formed inside an enclave and passed to the 6to4 router, they are suspicious and must be dropped. In accordance with DoD IPv6 IA Guidance for MO3 (S5-C7-8), packets as such must be dropped and logged as a security event.Information Assurance Officer

Checks

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv4 packets that are tunneling IPv6 packets.

V-30736 No Change

Findings ID:	NET-IPV6-066	Rule ID:	SV-40541r1_rule	Severity:	low	CCI:

Discussion

An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in pairs and thus do not require manual configuration because they treat the IPv4 infrastructure as a virtual non-broadcast link, using an IPv4 address embedded in the IPv6 address to find the remote end of the tunnel. In other words, the tunnel destination is determined by the IPv4 address of the external interface of the 6to4 router that is concatenated to the 2002::/16 prefix in the format 2002: V4ADDR::/48. Hence, the imbedded V4ADDR of the 6to4 prefix must belong to the same ipv4 prefix as configured on the external-facing interface of the 6to4 router. Information Assurance Officer

Checks

Currently JUNOS does not support 6to4 automatic tunneling so this vulnerability is not applicable

Fix

If the router is functioning as a 6to4 router, configure an egress filter (inbound on the internal-facing interface) to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave.

V-30744 No Change

Findings ID:	NET-TUNL-034	Rule ID:	SV-40557r1_rule	Severity:	medium	CCI:

Discussion

L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.Information Assurance Officer

Checks

Currently JUNOS does not support L2TPv3 so this vulnerability is not applicable.

Fix

Configure L2TPv3 to use authentication for any peering sessions.

V-31285 No Change

Findings ID:	NET0408	Rule ID:	SV-41556r2_rule	Severity:	medium	CCI:

Discussion

As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 also requires that sequence numbers are checked against the window size before accepting data or control flags as valid. A router receiving an RST segment will close the TCP session with the BGP peer that is being spoofed; thereby, purging all routes learned from that BGP neighbor. A RST segment is valid as long as the sequence number is within the window. The TCP reset attack is made possible due to the requirements that Reset flags should be processed immediately and that a TCP endpoint must accept out of order packets that are within the range of a window size. This reduces the number of sequence number guesses the attack must make by a factor equivalent to the active window size. Each sequence number guess made by the attacker can be simply incremented by the receiving connections window size. The BGP peering session can protect itself against such an attack by authenticating each TCP segment. The TCP header options include an MD5 signature in every packet and are checked prior to the acceptance and processing of any TCP packet—including RST flags.

One way to create havoc in a network is to advertise bogus routes to a network. A rogue router could send a fictitious routing update to convince a BGP router to send traffic to an incorrect or rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or merely used to disrupt the network’s ability to effectively communicate with other networks. An autonomous system can advertise incorrect information by sending BGP updates messages to routers in a neighboring AS. A malicious AS can advertise a prefix originated from another AS and claim that it is the originator (prefix hijacking). Neighboring autonomous systems receiving this announcement will believe that the malicious AS is the prefix owner and route packets to it.

Checks

Review the router configuration to determine if authentication is being used for all peers. An authentication key should be defined for each BGP neighbor regardless of the autonomous system the peer belongs as shown in the following example:

protocols bgp {
group external-peers {
type external;
neighbor 171.69.232.90 {
peer-as 200;
authentication-key xxxxx;
}
neighbor 171.69.232.100 {
peer-as 300;
authentication-key xxxxx;
}
}
}

Note: The authentication-key statement can be applied at the BGP level, at the group level, or at the neighbor level.

Fix

Configure the device to authenticate all BGP peers.

Incompatible Browser Detected - Internet Explorer

Infrastructure Router Security Technical Implementation Guide Juniper

STIG Details

Comparison Details

Compare/View Releases

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix