Perimeter Router Security Technical Implementation Guide Juniper
Description
Perimeter Router Security Technical Implementation Guide – Juniper
Details
Version / Release: V8R32
Published: 2018-11-28
Updated At: 2019-01-27 11:45:16
Compare/View Releases
Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Actions
Download
Filter
Severity | Open | Not Reviewed | Not Applicable | Not a Finding |
---|---|---|---|---|
Overall | 0 | 0 | 0 | 0 |
Low | 0 | 0 | 0 | 0 |
Medium | 0 | 0 | 0 | 0 |
High | 0 | 0 | 0 | 0 |
Vuln | Rule | Version | CCI | Severity | Title | Description | Status | Finding Details | Comments |
---|---|---|---|---|---|---|---|---|---|
SV-15475r3_rule | NET1020 | LOW | The network device must log all access control lists (ACL) deny statements. | Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, attempted to be done, and by whom in order to compile an accurate risk assessment. Auditing the actions on network d | |||||
SV-3008r1_rule | NET1800 | MEDIUM | The IAO will ensure IPSec VPNs are established as tunnel type VPNs when transporting management traffic across an ip backbone network. | Using dedicated paths, the OOBM backbone connects the OOBM gateway routers located at the premise of the managed networks and at the NOC. Dedicated links can be deployed using provisioned circuits (ATM, Frame Relay, SONET, T-carrier, and others or VPN te | |||||
SV-3012r4_rule | NET0230 | HIGH | Network devices must be password protected. | Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to | |||||
SV-3013r5_rule | NET0340 | MEDIUM | Network devices must display the DoD-approved logon banner warning. | All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized | |||||
SV-15454r2_rule | NET1639 | MEDIUM | The network element must timeout management connections for administrative access after 10 minutes or less of inactivity. | Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance Officer | |||||
SV-15331r2_rule | NET0820 | LOW | The network element must have DNS servers defined if it is configured as a client resolver. | The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of | |||||
SV-15333r2_rule | NET0890 | MEDIUM | The network element must only allow write and poll SNMP access by authorized internal IP addresses. | Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.Information Assuranc | |||||
SV-3022r2_rule | NET0892 | MEDIUM | The administrator must ensure SNMP is blocked at all external interfaces. | SNMP information can be used to trace the network and reveal networks topology that could enable malicious users to gain access to network devices. | |||||
SV-15367r2_rule | NET0911 | MEDIUM | Internet Control Message Types (ICMP) must be blocked inbound from external untrusted networks (e.g., ISP and other non-DoD networks). | Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Tec | |||||
SV-15369r2_rule | NET0912 | MEDIUM | Internet Control Message Types (ICMP) must be blocked outbound to external untrusted networks (e.g., ISP and other non-DoD networks). | Using ICMP messages for information gathering is a process allowing malicious computer attackers to launch attacks against a targeted network. In this stage the malicious attacker will try to determine what the characteristics of the targeted network. Tec | |||||
SV-15377r4_rule | NET0918 | LOW | Outbound ICMP Time Exceed messages must be blocked to prevent network discovery by unauthorized users. | The trace route tool will display routes and trip times on an IP network. An attacker can use trace route responses to create a map of the subnets and hosts behind the perimeter router, just as they could do with pings. The traditional trace route relie | |||||
SV-15291r2_rule | NET0400 | MEDIUM | The network element must authenticate all IGP peers. | A rogue router could send a fictitious routing update to convince a site’s premise router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information of the site’s network, or | |||||
SV-15299r2_rule | NET0410 | MEDIUM | BGP connections must be restricted to authorized IP addresses of neighbors from trusted Autonomous Systems. | Advertisement of routes by an autonomous system for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes DoS on the network that allocated the block of addresses and may cause DoS on the netwo | |||||
SV-3043r4_rule | NET1675 | MEDIUM | The network device must use different SNMP community names or groups for various levels of read and write access. | Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking | |||||
SV-3056r7_rule | NET0460 | HIGH | Group accounts must not be configured for use on the network device. | Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the | |||||
SV-15472r4_rule | NET0465 | MEDIUM | Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. | By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mi | |||||
SV-3058r5_rule | NET0470 | MEDIUM | Unauthorized accounts must not be configured for access to the network device. | A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service | |||||
SV-41451r2_rule | NET0600 | HIGH | The network element must be configured to ensure passwords are not viewable when displaying configuration information. | Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the console or printout of the configuration. Information Assura | |||||
SV-15452r4_rule | NET1638 | MEDIUM | Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. | Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted | |||||
SV-15456r2_rule | NET1640 | LOW | The network element must log all attempts to establish a management connection for administrative access. | Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. Wit | |||||
SV-3077r4_rule | NET0710 | LOW | Link Layer Discovery Protocols (LLDPs) must be disabled on all external facing interfaces. | LLDPs are primarily used to obtain protocol addresses of neighboring devices and discover platform capabilities of those devices. Use of SNMP with the LLDP Management Information Base (MIB) allows network management applications to learn the device type a | |||||
SV-15306r2_rule | NET0730 | LOW | The network element must have the Finger service disabled. | The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to find out who is using the network, they may use social engi | |||||
SV-15317r2_rule | NET0770 | MEDIUM | The router must have IP source routing disabled. | Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.Information Assurance Officer | |||||
SV-15319r1_rule | NET0800 | MEDIUM | The administrator must ensure ICMP unreachable notifications, mask replies, and redirects are disabled on all external interfaces of the premise router. | The Internet Control Message Protocol (ICMP) supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Three ICMP messages are commonly used by att | |||||
SV-41468r2_rule | NET0740 | MEDIUM | The network element must have HTTP service for administrative access disabled. | The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router. Most recent software | |||||
SV-3143r4_rule | NET0240 | HIGH | Network devices must not have any default manufacturer passwords. | Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not | |||||
SV-15303r2_rule | NET0700 | MEDIUM | The network element must be running a current and supported operating system with all IAVMs addressed. | Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes an | |||||
SV-15424r2_rule | NET0950 | HIGH | The network device must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) Strict mode or via egress ACL. | When Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the router would use to forward the return packet. Information Assurance | |||||
SV-16144r3_rule | NET0960 | MEDIUM | TCP intercept features must be provided by the network device by implementing a filter to rate limit and protect publicly accessible servers from any TCP SYN flood attacks from an outside network. | The TCP SYN attack involves transmitting a volume of connections that cannot be completed at the destination. This attack causes the connection queues to fill up, thereby denying service to legitimate TCP users. | |||||
SV-28748r3_rule | NET1636 | HIGH | The network device must require authentication prior to establishing a management connection for administrative access. | Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network ou | |||||
SV-3196r4_rule | NET1660 | HIGH | The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. | SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an | |||||
SV-3210r4_rule | NET1665 | HIGH | The network device must not use the default or well-known SNMP community strings public and private. | Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device usi | |||||
SV-30085r5_rule | NET0440 | MEDIUM | In the event the authentication server is unavailable, the network device must have a single local account of last resort defined. | Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between t | |||||
SV-15445r2_rule | NET1624 | MEDIUM | The network element must time out access to the console port after 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminati | |||||
SV-16198r1_rule | NET0920 | MEDIUM | The administrator must bind the ingress ACL filtering packets entering the network to the external interface on an inbound direction. | Access lists are used to separate data traffic into that which it will route (permitted packets) and that which it will not route (denied packets). Secure configuration of routers makes use of access lists for restricting access to services on the router | |||||
SV-30087r3_rule | NET0894 | MEDIUM | The network device must only allow SNMP read-only access. | Enabling write access to the router via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance OfficerECSC-1 | |||||
SV-3982r3_rule | NET-TUNL-013 | MEDIUM | L2TP must not pass into the private network of an enclave. | Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for deliv | |||||
SV-28747r3_rule | NET1623 | HIGH | The network device must require authentication for console access. | Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Inform | |||||
SV-4583r1_rule | NET0580 | LOW | The router administrator will ensure a password is required to gain access to the router's diagnostics port. | If unauthorized users gain access to the routers diagnostic port, it is possible to disrupt service.Information Assurance Officer | |||||
SV-15477r2_rule | NET1021 | LOW | The network element must log all messages except debugging and send all log data to a syslog server. | Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. | |||||
SV-4622r2_rule | NET0162 | HIGH | The ISSO/NSO will ensure premise router interfaces that connect to an AG (i.e., ISP) are configured with an ingress ACL that only permits packets with destination addresses within the sites address space. | Any enclave with one or more AG connections will have to take additional steps to ensure that neither their network nor the NIPRNet is compromised. Without verifying the destination address of traffic coming from the site’s AG, the premise router could | |||||
SV-4623r2_rule | NET0164 | HIGH | The ISSO/NSO will ensure the premise router does not have a routing protocol session with a peer router belonging to an AS (Autonomous System) of the AG service provider. A static route is the only acceptable route to an AG. | The premise router will not use a routing protocol to advertise NIPRNet addresses to the AG. Most ISPs use Border Gateway Protocol (BGP) to share route information with other autonomous systems (AS), that is, any network under a different administrative c | |||||
SV-4624r2_rule | NET0166 | LOW | The IAO/NSO will ensure the AG network service provider IP addresses are not redistributed into or advertised to the NIPRNet or any router belonging to any other Autonomous System (AS) i.e. to another AG device in another AS. | Unsolicited traffic that may inadvertently attempt to enter the NIPRNet by traversing the enclave's premise router can be avoided by not redistributing NIPRNet routes into the AG. | |||||
SV-15450r3_rule | NET1637 | MEDIUM | The network element must only allow management connections for administrative access from hosts residing in to the management network. | Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and | |||||
SV-28744r2_rule | NET1645 | MEDIUM | The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. | An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for | |||||
SV-28745r2_rule | NET1646 | MEDIUM | The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface. | An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer | |||||
SV-15437r4_rule | NET0965 | MEDIUM | The network device must drop half-open TCP connections through filtering thresholds or timeout periods. | A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance of that acknowledgement is sent by the originator. An att | |||||
SV-15365r1_rule | NET0910 | MEDIUM | The SA will utilize ingress and egress ACLs to restrict traffic destined to the enclave perimter in accordance with the guidelines contained in DoD Instruction 8551.1 for all ports and protocols required for operational commitments.commitments. | Vulnerability assessments must be reviewed by the SA and protocols must be approved by the IA staff before entering the enclave. Access Control Lists (ACLs) are the first line of defense in a layered security approach. They permit authorized packets and | |||||
SV-15447r2_rule | NET1629 | LOW | The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. | The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the de | |||||
SV-15257r2_rule | NET0167 | MEDIUM | The ISSO/NSO will ensure the route to the AG network adheres to the PPS CAL boundary 13 and 14 policies and is in compliance with all perimeter filtering defined in the perimeter and router sections of the Network STIG. | The enclave perimeter requirement for filtering, to include JTF-GNO PPS filtering rules, and monitoring traffic will be enforced for any traffic from the AG. All traffic entering the enclave from the AG must enter through the firewall and be monitored by | |||||
SV-28426r2_rule | NET-IPV6-004 | MEDIUM | Router advertisements must be suppressed on all external-facing IPv6-enabled interfaces. | Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. IPSec AH was originally suggested as mitigation for the link local attacks, but has since been found to have bootstrapping problems and to b | |||||
SV-15300r2_rule | NET0412 | MEDIUM | Each eBGP neighbor must be authenticated with a unique password. | If the same passwords are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It is possible that a malicious user exists in one autonomous system who would know the password used for the eBGP session. This | |||||
SV-15301r4_rule | NET0422 | LOW | Network devices must be configured with rotating keys used for authenticating IGP peers that have a duration of 180 days or less. | If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being gues | |||||
SV-15312r1_rule | NET0742 | MEDIUM | The router administrator will ensure FTP server is disabled. | The additional services enabled on a router increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an attacker to gain access to the router.Information Assurance Office | |||||
SV-15315r2_rule | NET0744 | MEDIUM | The network element must have all BSDr commands disabled. | Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote acce | |||||
SV-16478r2_rule | NET-IPV6-016 | MEDIUM | The network element must be configured so that ICMPv6 unreachable notifications and redirects are disabled on all external facing interfaces. | The Internet Control Message Protocol version 6 (ICMPv6) supports IPv6 traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMPv6 messages under a wide variety of conditions. ICMPv6 messages are commonly | |||||
SV-41501r3_rule | NET0813 | MEDIUM | The network element must authenticate all NTP messages received from NTP servers and peers. | Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted | |||||
SV-16092r2_rule | NET0897 | LOW | The router must use its loopback or OOB management interface address as the source address when originating TACACS+ or RADIUS traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag | |||||
SV-15341r2_rule | NET0898 | LOW | The router must use its loopback or OOB management interface address as the source address when originating syslog traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag | |||||
SV-15344r2_rule | NET0899 | LOW | The router must use its loopback or OOB management interface address as the source address when originating NTP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag | |||||
SV-15347r2_rule | NET0900 | LOW | The router must use its loopback or OOB management interface address as the source address when originating SNMP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag | |||||
SV-15350r2_rule | NET0901 | LOW | The router must use its loopback or OOB management interface address as the source address when originating NetFlow traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of routers. It is easier to construct appropriate ingress filters for router management plane traffic destined to the network manag | |||||
SV-15353r3_rule | NET0902 | LOW | The network device must use its loopback or OOB management interface address as the source address when originating TFTP or FTP traffic. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability of network devices. It is easier to construct appropriate ingress filters for management plane traffic destined to the network mana | |||||
SV-15360r2_rule | NET0903 | LOW | The router must use its loopback interface address as the source address for all iBGP peering sessions. | Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability. It is easier to construct appropriate filters for control plane traffic. Log information recorded by authentication and syslog ser | |||||
SV-15361r1_rule | NET-IPV6-006 | MEDIUM | The system administrator will ensure the undetermined transport packet is blocked at the perimeter in an IPv6 enclave by the router. | One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This is a packet that contains an undetermined protocol due to fragmentation. Depending on the length of the IPv6 extension header chain, the initial fragment may no | |||||
SV-15363r2_rule | NET-IPV6-017 | MEDIUM | The network element must be configured to ensure the routing header extension type 0, 1, and 3-255 are rejected in an IPv6 enclave. | The Routing header is used by an IPv6 source to specify a list of intermediate nodes that a packet has to traverse on the path to its destination. If the packet cannot take the path, it is returned to the source node in an ICMPv6 unreachable error messag | |||||
SV-40968r1_rule | NET-IPV6-010 | MEDIUM | The network element can permit inbound ICMPv6 messages Packet-too-big (type 2), Time Exceeded (type 3), Parameter Problem (type 4), Echo Reply (type 129), and Neighbor Discovery (type 135-136). Remaining ICMPv6 messages must be blocked inbound. | Scanning will usually be the major stage of an information gathering process a malicious computer attacker will launch against a targeted network. With this stage the malicious computer attacker will try to determine what the characteristics of the target | |||||
SV-15375r2_rule | NET-IPV6-011 | MEDIUM | The network element can permit outbound ICMPv6 messages Packet-too-big (type 2), Echo Request (type 128), and Neighborhood Discovery (type 135-136). Remaining ICMPv6 messages must be blocked outbound. | Scanning will usually be the major stage of an information gathering process a malicious computer attacker will lunch against a targeted network. With this stage the malicious computer attacker will try to determine what the characteristics of the targete | |||||
SV-15382r2_rule | NET0921 | MEDIUM | The administrator must bind the egress ACL filtering packets leaving the network to the internal interface on an inbound direction. | Access lists are used to separate data traffic into that which it will route (permitted packets) and that which it will not route (denied packets). Secure configuration of routers makes use of access lists for restricting access to services on the router | |||||
SV-15385r2_rule | NET0923 | HIGH | Inbound IP packets with a local host loopback address (127.0.0.0/8) must be blocked, denied, or dropped at the perimeter device. | This type of IP address spoofing occurs when someone outside the network uses a local host address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that informat | |||||
SV-15388r2_rule | NET0924 | HIGH | Inbound IP packets using link-local address space (169.254.0.0/16) must be blocked, denied, or dropped at the perimeter device. | This type of IP address spoofing occurs when someone outside the network uses a link-local address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that informat | |||||
SV-47836r2_rule | NET0926 | HIGH | Inbound packets using IP addresses specified in the RFC5735 and RFC6598, along with network address space allocated by IANA, but not assigned by the RIRs for ISP and other end-customer use must be blocked, denied, or dropped at the perimeter device. | This type of IP address spoofing occurs when someone outside the network uses an address that should not be routed or has not been officially assigned to an ISP for use by the RIR to gain access to systems or devices on the internal network. If the intrud | |||||
SV-15394r2_rule | NET0927 | HIGH | Inbound IP packets using RFC 1918 address space (10.0.0.0/8, 172.16.0.0 /12, and 192.168.0 /16) must be blocked, denied, or dropped at the perimeter device. | This type of IP address spoofing occurs when someone outside the network uses an RFC1918 address to gain access to systems or devices on the internal network. If the intruder is successful, they can intercept data, passwords, etc., and use that informatio | |||||
SV-15397r2_rule | NET-IPV6-025 | MEDIUM | The network device must be configured to ensure IPv6 Site Local Unicast addresses are not defined in the enclave, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF. | As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect netw | |||||
SV-15400r2_rule | NET-IPV6-026 | HIGH | The network element must be configured to ensure IPv6 Site Local Unicast addresses are blocked on the ingress inbound and egress outbound filters, (FEC0::/10). Note that this consist of all addresses that begin with FEC, FED, FEE and FEF. | As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not contain any indication of the site to which it belongs. The use of site-local addresses has the potential to adversely affect netw | |||||
SV-15403r1_rule | NET-IPV6-027 | HIGH | The network element must be configured restrict to accept the device from accepting any inbound IP packets with a local host loop back address, (0:0:0:0:0:0:0:1 or ::1/128). | The unicast address 0:0:0:0:0:0:0:1, also defined ::1/128 is called the loopback address. A node could use it to send an IPv6 packet to itself. It should never be assigned to any physical interface. It is treated as having link-local scope, and may be | |||||
SV-15406r1_rule | NET-IPV6-028 | HIGH | The network element must be configured to restrict the acceptance of any IP packets from the unspecified address, (0:0:0:0:0:0:0:0 or ::/128). | The address 0:0:0:0:0:0:0:0, also defined ::/128 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an init | |||||
SV-15407r3_rule | NET-IPV6-029 | MEDIUM | The network device must block IPv6 multicast addresses used as a source address. | IPv6 multicast addresses should never be a source address. They should only be destination addresses.Information Assurance Officer | |||||
SV-15412r1_rule | NET-IPV6-030 | MEDIUM | The IAO/NSO will ensure IPv6 addresses with embedded IPv4-compatible IPv6 addresses are blocked on the ingress and egress filters, (0::/96). | The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address | |||||
SV-15415r1_rule | NET-IPV6-031 | MEDIUM | The IAO/NSO will ensure that IPv6 addresses with embedded IPv4-mapped IPv6 addresses are blocked on the ingress and egress filters, (0::FFFF/96). | The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address | |||||
SV-15421r2_rule | NET-IPV6-032 | MEDIUM | The network device must block IPv6 Unique Local Unicast Addresses on the enclaves perimeter ingress and egress filter. | The IANA has assigned the FC00::/7 prefix to Unique Local Unicast addresses. Unique Local Address (ULA) is a routable address that is not intended to be on the Internet. Site border routers and firewalls should be configured to block any packets with UL | |||||
SV-15430r1_rule | NET-IPV6-034 | MEDIUM | The network element must be configured from accepting any outbound IP packet that contains an illegitimate address in the source address field via egress ACL or by enabling Unicast Reverse Path Forwarding in an IPv6 enclave. | Unicast Reverse Path Forwarding (uRPF) provides a mechanism for IP address spoof protection. When uRPF is enabled on an interface, the router examines all packets received as input on that interface to make sure that the source address and source interfa | |||||
SV-15461r2_rule | NET1647 | MEDIUM | The network element must not use SSH Version 1 for administrative access. | SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabli | |||||
SV-16067r2_rule | NET-TUNL-017 | MEDIUM | ISATAP tunnels must terminate at an interior router. | ISATAP is an automatic tunnel mechanism that does not provide authentication such as IPSec. As a result of this limitation, ISATAP is thought of as a tool that is used inside the enclave among trusted hosts, which would limit it to internal attacks. ISA | |||||
SV-16073r1_rule | NET-TUNL-019 | MEDIUM | The IAO/NSO will ensure the ingress filter drops unexpected protocol 41 packets at the 6to4 site router before sensor inspection. | 6to4 is an automated tunneling mechanism that provides v6 capability to a dual-stack node or v6 capable site that has only IPv4 connectivity to the site. One key difference between automatic 6to4 tunnels and manually configured tunnels is that the tunnel | |||||
SV-16075r5_rule | NET-TUNL-020 | HIGH | Teredo packets must be blocked inbound to the enclave and outbound from the enclave. | Teredo (RFC 4380) is a tunneling mechanism that allows computers to encapsulate IPv6 packets inside IPv4 to traverse IPv4-only networks. It relies on UDP to allow the tunnel to traverse NAT devices. Teredo uses UDP port 3544 to communicate with Teredo re | |||||
SV-16076r1_rule | NET-IPV6-048 | MEDIUM | The IAO/NSO will ensure in NAT-PT architecture there is no tunneled IPv4 in IPv6 traffic. | Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate data sent between IP-heterogeneous nodes. NAT-PT translates a IPv4 datagram into a semantically equivalent IPv6 datagram or vi | |||||
SV-16078r2_rule | NET-IPV6-047 | MEDIUM | Interfaces supporting IPv4 in NAT-PT Architecture must not receive IPv6 traffic. | Network Address Translation with Protocol Translation (NAT-PT), defined in [RFC2766], is a service that can be used to translate data sent between IP-heterogeneous nodes. NAT-PT translates IPv4 datagrams into a semantically equivalent IPv6 datagram or vic | |||||
SV-16259r4_rule | NET0433 | MEDIUM | Network devices must use two or more authentication servers for the purpose of granting administrative access. | The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ o | |||||
SV-16261r5_rule | NET0441 | HIGH | The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. | The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate autho | |||||
SV-18945r2_rule | NET1807 | MEDIUM | IPSec tunnels used to transit management traffic must be restricted to only the authorized management packets based on destination and source IP address. | The Out-of-Band Management (OOBM) network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device enabling n | |||||
SV-19063r1_rule | NET1808 | MEDIUM | Gateway configuration at the remote VPN end-point is a not a mirror of the local gateway | The IPSec tunnel end points may be configured on the OOBM gateway routers connecting the managed network and the NOC. They may also be configured on a firewall or VPN concentrator located behind the gateway router. In either case, the crypto access-list u | |||||
SV-19298r1_rule | NET0985 | MEDIUM | IGP instances configured on the OOBM gateway router do not peer only with their appropriate routing domain | If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains | |||||
SV-19300r1_rule | NET0986 | MEDIUM | The routes from the two IGP domains are redistributed to each other. | If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. Since the managed network and the management network are separate routing domains | |||||
SV-19302r2_rule | NET0987 | MEDIUM | Traffic from the managed network is able to access the OOBM gateway router | If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the O | |||||
SV-19304r1_rule | NET0988 | MEDIUM | Traffic from the managed network will leak into the management network via the gateway router interface connected to the OOBM backbone. | If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries such as using interface ACLs or filters at the boundaries between the two networks | |||||
SV-19306r1_rule | NET0989 | MEDIUM | Management network traffic is leaking into the managed network. | If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. To provide separation, access control lists or filters must be configured to bloc | |||||
SV-20206r2_rule | NET0991 | MEDIUM | The network element’s OOBM interface must be configured with an OOBM network address. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; th | |||||
SV-20209r1_rule | NET0992 | MEDIUM | The management interface is not configured with both an ingress and egress ACL. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac | |||||
SV-19335r2_rule | NET0993 | LOW | The network element’s management interface is not configured as passive for the IGP instance deployed in the managed network. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interfac | |||||
SV-19318r2_rule | NET1000 | MEDIUM | The gateway router for the managed network is not configured with an ACL or filter on the egress interface to block all outbound management traffic. | The management network must still have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes such as routers and firewalls. Management traffic between the managed network elements and the management network is | |||||
SV-19309r1_rule | NET1005 | MEDIUM | An inbound ACL is not configured for the management network sub-interface of the trunk link to block non-management traffic. | If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case, the management network still has its own subnet while at the | |||||
SV-19311r1_rule | NET1006 | MEDIUM | Traffic entering the tunnels is not restricted to only the authorized management packets based on destination address. | Similar to the OOBM model, when the production network is managed in-band, the management network could also be housed at a NOC that is located locally or remotely at a single or multiple interconnected sites. NOC interconnectivity as well as connectivity | |||||
SV-19314r1_rule | NET1007 | LOW | Management traffic is not classified and marked at the nearest upstream MLS or router when management traffic must traverse several nodes to reach the management network. | When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. | |||||
SV-19098r1_rule | NET1008 | LOW | The core router within the managed network has not been configured to provide preferred treatment for management traffic that must traverse several nodes to reach the management network. | When network congestion occurs, all traffic has an equal chance of being dropped. Prioritization of network management traffic must be implemented to ensure that even during periods of severe network congestion, the network can be managed and monitored. | |||||
SV-20061r3_rule | NET-SRVFRM-003 | MEDIUM | Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture. | Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of | |||||
SV-20162r1_rule | NET-IPV6-024 | MEDIUM | The IAO/NSO will ensure IPv6 6-to-4 addresses with a prefix of 2002::/16 are dropped at the enclave perimeter by the ingress and egress filters. | “6-to-4” is a tunneling IPv6 transition mechanism [RFC 3056]. The guidance is the default case, which assumes that 6-to-4 is not being used as an IPv6 transition mechanism. If 6-to-4 is implemented, reference addition 6-to-4 guidance defined in the ST | |||||
SV-20167r1_rule | NET-IPV6-008 | MEDIUM | The IAO/NSO will ensure IPv6 6bone address space is blocked on the ingress and egress filter, (3FFE::/16). | The decommissioned 6bone allocation (3FFE::/16), RFC 3701 must be blocked. It is no longer a trusted source. Information Assurance Officer | |||||
SV-47337r1_rule | NET-TUNL-001 | MEDIUM | The network device must drop all inbound and outbound IPv4 and IPv6 packets being tunneled with outdated protocols. | There are a number of outdated tunneling schemes that should be blocked to avoid importing IPv6 packets. DoD IPv6 IA Guidance for MO3 (S0-C7-2) has identified the following to be blocked at the perimeter: Source Demand Routing Protocol (SDRP) AX.25 IP-w | |||||
SV-20200r2_rule | NET-TUNL-004 | MEDIUM | Tunnel entry point and the tunnel exit point must contain filters for expected tunnel protocol traffic with source and destination addresses and deny the remaining traffic by default. | Tunnel endpoints that do not have the same controls as the network perimeter requirements become an unprotect entry point into the enclave.Information Assurance OfficerECSC-1 | |||||
SV-20202r2_rule | NET-TUNL-003 | MEDIUM | Tunnel endpoints must be explicitly defined as auto configuration tunnels are not permitted. | IPv6-in-IPv4 tunnels require explicit configuration (on the tunnel exit point node) of both the tunnel exit point IP address and the corresponding tunnel entry point address . These are the outer IP layer destination and source addresses respectively. U | |||||
SV-20212r2_rule | NET-TUNL-002 | HIGH | Tunneled packets must be filtered at the tunnel exit point. | Once a tunnel has been terminated, the inner packet is no different than any other packet. Therefore, the inner packet must be filtered at the tunnel exit point network. In fact, some packets are more dangerous tunneled such as attacks against Neighbor | |||||
SV-20239r2_rule | NET-TUNL-006 | MEDIUM | Tunnel end-points must implement filters in accordance with mitigations defined in PPS Vulnerability Assessments. | Allowing unknown traffic into the enclave creates high risk and potential compromise by an intruder. Protocols used by applications the PPSM has reviewed and determined to require additional mitigation is necessary to protect the GIG.Information Assurance | |||||
SV-20240r2_rule | NET-TUNL-007 | MEDIUM | Tunnel entry and exit points must be in a deny-by-default security posture. | Having tunnels in a permit any any posture allow traffic to enter and exit the enclave without control from the Information Assurance team or SA.Information Assurance OfficerECSC-1 | |||||
SV-21168r2_rule | NET0966 | MEDIUM | Control plane protection is not enabled. | The Route Processor (RP) is critical to all network operations as it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the router | |||||
SV-21170r1_rule | NET-MCAST-010 | LOW | Long Name: The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic. | A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, | |||||
SV-41498r1_rule | NET0812 | LOW | The network element must use two or more NTP servers to synchronize time. | Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches, and firewalls, it will be very difficult to determine the e | |||||
SV-30843r1_rule | NET1970 | HIGH | The IAO will ensure that the router or firewall software has been upgraded to mitigate the risk of DNS cache poisoning attack caused by a flawed PAT implementation using a predictable source port allocation method for DNS query traffic. | DNS cache poisoning is an attack technique that allows an attacker to introduce forged DNS information into the cache of a caching name server. There are inherent deficiencies in the DNS protocol and defects in implementations that facilitate DNS cache po | |||||
SV-36774r5_rule | NET0405 | MEDIUM | A service or feature that calls home to the vendor must be disabled. | Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could | |||||
SV-40313r1_rule | NET-MCAST-001 | MEDIUM | The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing. | A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, | |||||
SV-40316r1_rule | NET-MCAST-002 | MEDIUM | The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled. | Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a | |||||
SV-40319r1_rule | NET-MCAST-009 | MEDIUM | The administrator must ensure that boundaries are established at the enclave perimeter for all administrative scoped multicast traffic. | A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, | |||||
SV-40387r1_rule | NET-IPV6-060 | MEDIUM | The administrator must ensure the perimeter router is configured to drop all inbound and outbound IPv6 packets containing a Hop-by-Hop header with invalid option type values. | These options are intended to be for the Destination Options header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it can’t recogniz | |||||
SV-40390r1_rule | NET-IPV6-059 | LOW | The administrator must ensure that the maximum hop limit is at least 32. | The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN s | |||||
SV-40399r1_rule | NET-IPV6-061 | MEDIUM | The administrator must ensure the perimeter router is configured to drop all inbound and outbound IPv6 packets containing a Destination Option header with invalid option type values. | These options are intended to be for the Hop-by-Hop header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many imiplementtions do not always drop packets with headers that it can’t recognize and hen | |||||
SV-40434r1_rule | NET-IPV6-062 | MEDIUM | The administrator must ensure the perimeter router is configured to drop all inbound and outbound IPv6 packets containing an extension header with the Endpoint Identification option. | The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it can’t recognize and hence could cause a DoS on the target device. In addition, the type, | |||||
SV-40439r1_rule | NET-IPV6-063 | MEDIUM | The administrator must ensure the perimeter router is configured to drop all inbound and outbound IPv6 packets containing the NSAP address option. | The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it can’t recognize and hence could cause a DoS on the target device. In addition, the type, | |||||
SV-40449r1_rule | NET-IPV6-064 | MEDIUM | The administrator must ensure the perimeter router is configured to drop all inbound and outbound IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type. | The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it can’t recognize and hence could cause a DoS on the target device. In addition, the type, | |||||
SV-40455r1_rule | NET-IPV6-065 | MEDIUM | The administrator must ensure the 6-to-4 router is configured to drop any IPv4 packets with protocol 41 received from the internal network. | The 6to4 specific filters accomplish the role of endpoint verification and provide assurance that the tunnels are being used properly. This primary guidance assumes that only the designated 6to4 router is allowed to form tunnel packets. If they are being | |||||
SV-40541r1_rule | NET-IPV6-066 | LOW | The administrator must ensure the 6-to-4 router is configured to drop any outbound IPv6 packets from the internal network with a source address that is not within the 6to4 prefix 2002:V4ADDR::/48 where V4ADDR is the designated IPv4 6to4 address for the enclave. | An automatic 6to4 tunnel allows isolated IPv6 domains to be connected over an IPv4 network and allows connections to remote IPv6 networks. The key difference between this deployment and manually configured tunnels is that the routers are not configured in | |||||
SV-40557r1_rule | NET-TUNL-034 | MEDIUM | The administrator must ensure the that all L2TPv3 sessions are authenticated prior to transporting traffic. | L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP | |||||
SV-41556r2_rule | NET0408 | MEDIUM | The network element must authenticate all BGP peers within the same or between autonomous systems (AS). | As specified in RFC 793, TCP utilizes sequence checking to ensure proper ordering of received packets. RFC 793 also specifies that RST (reset) control flags should be processed immediately, without waiting for out of sequence packets to arrive. RFC 793 al | |||||