Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Router Security Requirements Guide

V2R2 · · · Released 23 Oct 2015 · 28 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

The Router Security Requirements Guide (SRG) is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.
Digest of Updates vs. V2R0.1 · 24 Jul 2014 +28 −26

Comparison against the immediately-prior release (V2R0.1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 28

  • V-55721 Medium The router must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
  • V-55723 Medium The router must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • V-55727 Medium The router must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
  • V-55729 Medium The router must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.
  • V-55731 Medium The router must be configured so inactive router interfaces are disabled.
  • V-55733 Medium The router must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.
  • V-55735 Medium If Border Gateway Protocol (BGP) is enabled on the router, the router must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.
  • V-55739 Medium The router must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.
  • V-55741 Medium The router must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.
  • V-55747 Medium The router must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.
  • V-55749 Medium The router must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.
  • V-55753 Medium The router must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.
  • V-55757 Medium The router must enable neighbor router authentication for control plane protocols.
  • V-55759 Medium The router must be configured so that any key used for authenticating Interior Gateway Protocol peers does not have a duration exceeding 180 days.
  • V-55761 Medium The router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
  • V-55763 Medium The router must be configured to disable non-essential capabilities.
  • V-55765 Medium The router must encrypt all methods of configured authentication for routing protocols.
  • V-55767 Medium The router must use NIST-validated FIPS 140-2 cryptography to implement authentication encryption mechanisms for routing protocols.
  • V-55769 Medium The router must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM).
  • V-55771 Medium The router must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • V-55773 Medium The router must have IP source routing disabled.
  • V-55775 Medium The router must restrict BGP connections to known IP addresses of neighbor routers from trusted Autonomous Systems (AS).
  • V-55777 Medium The router must configure the maximum hop limit value to at least 32.
  • V-55779 Medium The router must stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort.
  • V-55781 Medium The router must protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.
  • V-55785 Medium The router must only allow incoming communications from authorized sources to be routed to authorized destinations.
  • V-55789 Medium The router must fail securely in the event of an operational failure.
  • V-55791 Medium The router must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including NSA configuration guides, Communications Tasking Orders (CTOs), and Directive-Type Memorandums (DTMs).

Removed rules 26

  • SRG-NET-000019-RTR-000002 Medium The router must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
  • SRG-NET-000019-RTR-000003 Medium The router must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • SRG-NET-000019-RTR-000004 Medium The router must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
  • SRG-NET-000019-RTR-000005 Medium The router must establish boundaries for Admin-Local or Site-Local scope multicast traffic.
  • SRG-NET-000019-RTR-000007 Medium The router must be configured so inactive router interfaces are disabled.
  • SRG-NET-000019-RTR-000008 Medium The router must be configured with a filter to deny all traffic applied to all inactive interfaces.
  • SRG-NET-000019-RTR-000009 Medium The router must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.
  • SRG-NET-000019-RTR-000010 Medium If BGP is enabled on the router, the router must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.
  • SRG-NET-000019-RTR-000011 Medium The router must not redistribute static routes to alternate gateway service provider into an EGP or IGP to the NIPRNet or to other Autonomous System.
  • SRG-NET-000019-RTR-000012 Medium The router must enforce that IGP instances configured on the Out Of Band Management (OOBM) gateway router only peer with their own routing domain.
  • SRG-NET-000019-RTR-000013 Medium The router must enforce that the managed network domain and the management network domain are separate routing domains and the IGP instances are not redistributed or advertised to each other.
  • SRG-NET-000019-RTR-000014 Medium The router must enforce that any interface used for OOBM traffic is configured to be passive for the IGP that is utilized on that interface.
  • SRG-NET-000020-RTR-000015 Medium The router must enforce information flow control using explicit security attributes on information, source, and destination objects. Security attributes used as a basis for flow control decisions may include, but are not limited to, IP addresses, port numbers, protocol, Autonomous System, and interface.
  • SRG-NET-000025-RTR-000020 Medium The router must enable neighbor router authentication for control plane protocols.
  • SRG-NET-000025-RTR-000085 Medium The router must be configured so that rotating keys are not used for authenticating IGP peers that have a duration exceeding 180 days.
  • SRG-NET-000026-RTR-000031 Medium The router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
  • SRG-NET-000131-RTR-000035 Medium The router must not have unnecessary services and functions enabled.
  • SRG-NET-000168-RTR-000077 Medium The router must encrypt all methods of configured authentication for routing protocols.
  • SRG-NET-000168-RTR-000078 Medium The router must use NIST-validated FIPS 140-2 cryptography to implement authentication encryption mechanisms for routing protocols.
  • SRG-NET-000191-RTR-000081 Medium The router must ensure all eBGP routers are configured to use Generalized TTL Security Mechanism (GTSM).
  • SRG-NET-000193-RTR-000111 Medium The router must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • SRG-NET-000195-RTR-000084 Medium The router must have IP source routing disabled.
  • SRG-NET-000195-RTR-000086 Medium The router must restrict BGP connections to known IP addresses of neighbor routers from trusted Autonomous Systems (AS).
  • SRG-NET-000205-RTR-000108 Medium The router must configure the maximum hop limit value to at least 32.
  • SRG-NET-000362-RTR-000108 Medium The router must protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.
  • SRG-NET-000364-RTR-000109 Medium The router must only allow incoming communications from authorized sources to be routed to authorized destinations.
Sort by
b
The router must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
AC-4 - Medium - CCI-001414 - V-55721 - SV-69975r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000002
Vuln IDs
  • V-55721
Rule IDs
  • SV-69975r1_rule
Information flow control regulates authorized information to travel within a network and between interconnected networks. Controlling the flow of network traffic is critical so it does not introduce any unacceptable risk to the network infrastructure or data. An example of a flow control restriction is blocking outside traffic claiming to be from within the organization. For most routers, internal information flow control is a product of system design.
Checks: C-56287r1_chk

Verify each router enforces approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy. If the router does not enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy, this is a finding.

Fix: F-60591r1_fix

Configure the router to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

b
The router must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
AC-4 - Medium - CCI-001414 - V-55723 - SV-69977r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000003
Vuln IDs
  • V-55723
Rule IDs
  • SV-69977r1_rule
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Limiting where, within the network, a given multicast group's data is permitted to flow is an important first step in improving multicast security. A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"; that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Therefore, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once this is done, the zones can be scoped as required.
Checks: C-56289r1_chk

If IPv4 or IPv6 multicast routing is enabled, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram. Review the router configuration to determine if multicast routing is enabled and which interfaces are enabled for PIM. If an interface is not required to support multicast routing and it is enabled, this is a finding.

Fix: F-60593r1_fix

Document all enabled interfaces for PIM in the network's multicast topology diagram. Disable support for PIM on interfaces that are not required to support it.

b
The router must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
AC-4 - Medium - CCI-001414 - V-55727 - SV-69981r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000004
Vuln IDs
  • V-55727
Rule IDs
  • SV-69981r1_rule
Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution trees for forwarding multicast traffic across the network infrastructure. Protocol Independent Multicast traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled. If a PIM neighbor filter is not applied to those interfaces that have PIM enabled, an unauthorized routers can join the PIM domain and discover and use the rendezvous points, and also advertise their rendezvous points into the domain. This can result in a denial of service by traffic flooding or result in the unauthorized transfer of data.
Checks: C-56293r1_chk

Review the multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing. If the router is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors. If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Fix: F-60597r1_fix

Configure neighbor filters to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor filters to all PIM enabled interfaces.

b
The router must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.
AC-4 - Medium - CCI-001414 - V-55729 - SV-69983r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000005
Vuln IDs
  • V-55729
Rule IDs
  • SV-69983r1_rule
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Administrative scoped multicast traffic must not cross the enclave perimeter in either direction. Restricting multicast traffic makes it more difficult for a malicious user to access sensitive traffic. Admin-Local scope is encouraged for any multicast traffic within a network intended for network management, as well as for control plane traffic that must reach beyond link-local destinations.
Checks: C-56295r1_chk

Review the multicast topology diagram to determine if there are any documented Admin-Local (FFx4::/16), Site-Local (FFx5::/16), or Organization-Local (FFx8::/16) multicast boundaries for IPv6 traffic or any Local-Scope (239.255.0.0/16) boundaries for IPv4 traffic. Verify the appropriate boundaries are configured on the applicable multicast-enabled interfaces. If the appropriate boundaries are not configured on applicable multicast-enabled interfaces, this is a finding.

Fix: F-60599r1_fix

Configure the appropriate boundaries to contain packets addressed within the administratively scoped zone. Defined multicast addresses are FFx4::/16, FFx5::/16, FFx8::/16, and 239.255.0.0/16.

b
The router must be configured so inactive router interfaces are disabled.
AC-4 - Medium - CCI-001414 - V-55731 - SV-69985r2_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000007
Vuln IDs
  • V-55731
Rule IDs
  • SV-69985r2_rule
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For sub-interfaces, delete sub-interfaces that are on inactive interfaces and delete sub-interfaces that are themselves inactive. If the sub-interface is no longer necessary for authorized communications, then it must be deleted.
Checks: C-56297r2_chk

View the configuration of the router. If an interface is not being used, but is configured or enabled, this is a finding.

Fix: F-60601r2_fix

Delete inactive sub-interfaces, and disable and delete the configuration of any inactive ports on the router.

b
The router must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.
AC-4 - Medium - CCI-001414 - V-55733 - SV-69987r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000009
Vuln IDs
  • V-55733
Rule IDs
  • SV-69987r1_rule
Enclaves with Alternate Gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's Alternate Gateway, the perimeter router could be routing transit data from the Internet into the NIPRNet. This could also make the perimeter router vulnerable to a DoS attack as well as provide a backdoor into the NIPRNet. The DoD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approved Gateway is secure through filters permitting packets with a destination address belonging to the DoD enclave's address block.
Checks: C-56301r1_chk

Review the configuration of each router interface connecting to an Alternate Gateway. Verify each permit statement of the ingress filter only permits packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the Alternate Gateway network service provider. If the ingress filter permits packets with addresses other than those specified, such as destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the Alternate Gateway network service provider, this is a finding.

Fix: F-60603r1_fix

Configure the ingress filter of the perimeter router connected to an Alternate Gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the Alternate Gateway network service provider.

b
If Border Gateway Protocol (BGP) is enabled on the router, the router must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.
AC-4 - Medium - CCI-001414 - V-55735 - SV-69989r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000010
Vuln IDs
  • V-55735
Rule IDs
  • SV-69989r1_rule
The perimeter router will not use a routing protocol to advertise NIPRNet addresses to Alternate Gateways. Most ISPs use Border Gateway Protocol (BGP) to share route information with other autonomous systems, that is, any network under a different administrative control and policy than a local site. If BGP is configured on the perimeter router, no BGP neighbors will be defined to peer routers from an AS belonging to any Alternate Gateway. The only allowable method is a static route to reach the Alternate Gateway.
Checks: C-56303r1_chk

Review the configuration of the router connecting to the Alternate Gateway. Verify there are no BGP neighbors configured to the remote AS that belongs to the Alternate Gateway service provider. If there are BGP neighbors connecting the remote AS of the Alternate Gateway service provider, this is a finding.

Fix: F-60607r1_fix

Configure a static route on the perimeter router to reach the AS of a router connecting to an Alternate Gateway.

b
The router must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.
AC-4 - Medium - CCI-001414 - V-55739 - SV-69993r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000011
Vuln IDs
  • V-55739
Rule IDs
  • SV-69993r1_rule
If the static routes to the alternate gateway are being redistributed into an Exterior Gateway Protocol or Interior Gateway Protocol to a NIPRNet gateway, this could make traffic on NIPRNet flow to that particular router and not to the Internet Access Point routers. This could not only wreak havoc with traffic flows on NIPRNet, but it could overwhelm the connection from the router to the NIPRNet gateway(s) and also cause traffic destined for outside of NIPRNet to bypass the defenses of the Internet Access Points.
Checks: C-56305r1_chk

Review the configuration of the route connecting to the Alternate Gateway. Verify redistribution of static routes to the Alternate Gateway is not occurring. If the static routes to the Alternate Gateway are being redistributed into an Exterior Gateway Protocol or Interior Gateway Protocol to a NIPRNet gateway, this is a finding.

Fix: F-60609r1_fix

Configure the router so that static routes are not redistributed to an Alternate Gateway into either an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.

b
The router must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.
AC-4 - Medium - CCI-001414 - V-55741 - SV-69995r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000012
Vuln IDs
  • V-55741
Rule IDs
  • SV-69995r1_rule
If the gateway router is not a dedicated device for the out-of-band management network, implementation of several safeguards for containment of management and production traffic boundaries must occur. Since the managed and management network are separate routing domains, configuration of separate Interior Gateway Protocol routing instances is critical on the router to segregate traffic from each network.
Checks: C-56307r1_chk

Verify that the out-of-band management interface is an adjacency in the Interior Gateway Protocol routing domain for the management network. If the router does not enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain, this is a finding.

Fix: F-60613r1_fix

Configure the router to enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.

b
The router must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.
AC-4 - Medium - CCI-001414 - V-55747 - SV-70001r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000013
Vuln IDs
  • V-55747
Rule IDs
  • SV-70001r1_rule
If the gateway router is not a dedicated device for the out-of-band management network, several safeguards must be implemented for containment of management and production traffic boundaries, otherwise, it is possible that management traffic will not be separated from production traffic. Since the managed network and the management network are separate routing domains, separate Interior Gateway Protocol routing instances must be configured on the router, one for the managed network and one for the out-of-band management network. In addition, the routes from the two domains must not be redistributed to each other.
Checks: C-56313r1_chk

Verify the Interior Gateway Protocol instance used for the managed network does not redistribute routes into the Interior Gateway Protocol instance used for the management network, and vice versa. If the Interior Gateway Protocol instance used for the managed network redistributes routes into the Interior Gateway Protocol instance used for the management network, or vice versa, this is a finding.

Fix: F-60617r1_fix

Configure the Interior Gateway Protocol instance used for the managed network to prohibit redistribution of routes into the Interior Gateway Protocol instance used for the management network, and vice versa.

b
The router must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.
AC-4 - Medium - CCI-001414 - V-55749 - SV-70003r1_rule
RMF Control
AC-4
Severity
M
CCI
CCI-001414
Version
SRG-NET-000019-RTR-000014
Vuln IDs
  • V-55749
Rule IDs
  • SV-70003r1_rule
The out-of-band management access switch will connect to the management interface of the managed network elements. The management interface can be a true out-of-band management interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will directly connect to the out-of-band management network. An out-of-band management interface does not forward transit traffic, thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an out-of-band management port, the interface functioning as the management interface must be configured so that management traffic, both data plane and control plane, does not leak into the managed network and that production traffic does not leak into the management network.
Checks: C-56317r1_chk

Review the configuration to verify the management interface is configured as passive for the Interior Gateway Protocol instance for the managed network. If the management interface is not configured as passive for the Interior Gateway Protocol instance for the managed network, this is a finding.

Fix: F-60621r1_fix

Configure the management interface as passive for the Interior Gateway Protocol instance configured for the managed network.

b
The router must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.
AC-4 - Medium - CCI-002190 - V-55753 - SV-70007r2_rule
RMF Control
AC-4
Severity
M
CCI
CCI-002190
Version
SRG-NET-000020-RTR-000015
Vuln IDs
  • V-55753
Rule IDs
  • SV-70007r2_rule
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. Restrictions can be enforced based on source and destination IP addresses, autonomous system numbers, or other attributes. This is normally an innate capability of a router in which attributes can be used by routing policies or rules to enforce organizational security policies.
Checks: C-56319r3_chk

If explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) are not used to enforce information flow control, this is a finding.

Fix: F-60623r2_fix

Configure the router to enforce organizational security policies by using explicit security attributes (for example, IP addresses, Autonomous System, or interface) on information, source, and destination objects as a basis for flow control decisions.

b
The router must enable neighbor router authentication for control plane protocols.
CM-6 - Medium - CCI-000366 - V-55757 - SV-70011r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000025-RTR-000020
Vuln IDs
  • V-55757
Rule IDs
  • SV-70011r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-56323r1_chk

Review the router configuration; for every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify that neighbor router authentication is enabled. If authentication is not enabled, this is a finding.

Fix: F-60627r1_fix

Configure authentication to be enabled for every protocol that affects the routing or forwarding tables.

b
The router must be configured so that any key used for authenticating Interior Gateway Protocol peers does not have a duration exceeding 180 days.
CM-6 - Medium - CCI-000366 - V-55759 - SV-70013r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000025-RTR-000085
Vuln IDs
  • V-55759
Rule IDs
  • SV-70013r1_rule
If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Some routing protocols allow the use of key chains for authentication. A key chain is a set of keys that are used in succession, with each having a lifetime of no more than 180 days. Changing the keys frequently reduces the risk of them eventually being guessed. Keys cannot be used during time periods for which they are not activated. If a time period occurs during which no key is activated, neighbor authentication cannot occur, and therefore routing updates will fail. Therefore, you should ensure that for a given key chain, key activation times overlap to avoid any period of time during which no key is activated.
Checks: C-56325r1_chk

For each authenticated routing protocol session, review the configured key expiration dates. If any key has a lifetime of more than 180 days, this is a finding.

Fix: F-60629r2_fix

For each authenticated routing protocol session, configure each key to have a lifetime of no more than 180 days.

b
The router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
SC-5 - Medium - CCI-001094 - V-55761 - SV-70015r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001094
Version
SRG-NET-000026-RTR-000031
Vuln IDs
  • V-55761
Rule IDs
  • SV-70015r1_rule
A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, which then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. The router must not accept any outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF) strict mode or by implementing an egress ACL. Unicast Reverse Path Forwarding (uRPF) provides an IP address spoof protection capability. When uRPF is enabled in strict mode, the packet must be received on the interface that the device would use to forward the return packet.
Checks: C-56327r2_chk

Review the router configuration to verify uRPF or an egress filter to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field has been configured on all internal interfaces. If uRPF or an egress filter to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces in an enclave, this is a finding.

Fix: F-60631r1_fix

Configure the router to ensure that an egress filter or uRPF is configured to restrict the router from accepting any outbound IP packet that contains an external IP address in the source field.

b
The router must be configured to disable non-essential capabilities.
CM-7 - Medium - CCI-000381 - V-55763 - SV-70017r1_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
SRG-NET-000131-RTR-000035
Vuln IDs
  • V-55763
Rule IDs
  • SV-70017r1_rule
A compromised router introduces risk to the entire network infrastructure as well as data resources that are accessible via the network. The perimeter defense has no oversight or control of attacks by malicious users within the network. Preventing network breaches from within is dependent on implementing a comprehensive defense-in-depth strategy including securing each device connected to the network. This is accomplished by following and implementing all security guidance applicable for each node type. A fundamental step in securing each router is to enable only the capabilities required for operation.
Checks: C-56329r1_chk

Review the router configuration to determine if services or functions not required for operation, or not related to router functionality (e.g., DNS, email client or server, FTP server, or web server) are enabled. If unnecessary services and functions are enabled on the router, this is a finding.

Fix: F-60633r1_fix

Remove unneeded services and functions from the router. Removal is recommended since the service or function may be inadvertently enabled otherwise. However, if removal is not possible, disable the service or function.

b
The router must encrypt all methods of configured authentication for routing protocols.
IA-7 - Medium - CCI-000803 - V-55765 - SV-70019r1_rule
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
SRG-NET-000168-RTR-000077
Vuln IDs
  • V-55765
Rule IDs
  • SV-70019r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-56331r1_chk

Review the router configuration; for every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify that neighbor router authentication is encrypting the authentication key. If authentication is not encrypting the authentication key, this is a finding.

Fix: F-60635r1_fix

Configure routing protocol authentication to encrypt the authentication key.

b
The router must use NIST-validated FIPS 140-2 cryptography to implement authentication encryption mechanisms for routing protocols.
IA-7 - Medium - CCI-000803 - V-55767 - SV-70021r1_rule
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
SRG-NET-000168-RTR-000078
Vuln IDs
  • V-55767
Rule IDs
  • SV-70021r1_rule
A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect or even a rogue destination. This diverted traffic could be analyzed to learn confidential information about the site's network, or merely used to disrupt the network's ability to communicate with other networks. This is known as a "traffic attraction attack" and is prevented by configuring neighbor router authentication for routing updates. However, using clear-text authentication provides little benefit since an attacker can intercept traffic and view the authentication key. This would allow the attacker to use the authentication key in an attack. Since MD5 is vulnerable to "birthday" attacks and may be compromised, routing protocol authentication must use FIPS 140-2 validated algorithms and modules to encrypt the authentication key. This requirement applies to all IPv4 and IPv6 protocols that are used to exchange routing or packet forwarding information; this includes all Interior Gateway Protocols (such as OSPF, EIGRP, and IS-IS) and Exterior Gateway Protocols (such as BGP), MPLS-related protocols (such as LDP), and Multicast-related protocols.
Checks: C-56333r2_chk

Review the router documentation to verify it is using NIST-validated FIPS 140-2 compliant cryptography for encrypted authentication mechanisms. If NIST-validated FIPS 140-2 compliant cryptography is not being used for all encrypted authentication mechanisms, this is a finding. Review the router configuration; for every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify that neighbor router authentication uses FIPS 140-2 validated algorithms to encrypt the authentication key. If routing protocol authentication is not using FIPS 140-2 validated algorithms to encrypt the authentication key, this is a finding.

Fix: F-60637r2_fix

Configure routing protocol authentication to use FIPS 140-2 validated algorithms and modules to encrypt the authentication key.

b
The router must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM).
SC-5 - Medium - CCI-002385 - V-55769 - SV-70023r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
SRG-NET-000191-RTR-000081
Vuln IDs
  • V-55769
Rule IDs
  • SV-70023r1_rule
As described in RFC 3682, Generalized TTL Security Mechanism (GTSM) is designed to protect a router's IP-based control plane from DoS attacks. Many attacks focused on CPU load and line-card overload can be prevented by implementing GTSM on all Exterior Border Gateway Protocol speaking routers. GTSM is based on the fact that the vast majority of control plane peering is established between adjacent routers; that is, the Exterior Border Gateway Protocol peers are either between connecting interfaces or between loopback interfaces. Since TTL spoofing is considered nearly impossible, a mechanism based on an expected TTL value provides a simple and reasonably robust defense from infrastructure attacks based on forged control plane traffic.
Checks: C-56335r1_chk

Review the router configuration; if it is not configured to use Generalized TTL Security Mechanism (GTSM) for all Exterior Border Gateway Protocol peering sessions, this is a finding.

Fix: F-60639r1_fix

Configure all Exterior Border Gateway Protocol peering sessions to use Generalized TTL Security Mechanism (GTSM).

b
The router must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
SC-5 - Medium - CCI-001095 - V-55771 - SV-70025r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001095
Version
SRG-NET-000193-RTR-000111
Vuln IDs
  • V-55771
Rule IDs
  • SV-70025r1_rule
Denial of service is a condition when a resource is not available for legitimate users. Packet flooding DDoS attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch using readily available tools such as Low Orbit Ion Cannon or by botnets. Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages).
Checks: C-56337r1_chk

Review the router configuration and interview the system administrator; verify that a mechanism for traffic prioritization and bandwidth reservation exists. This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies. If no such scheme exists or it is not configured, this is a finding.

Fix: F-60641r1_fix

Implement a mechanism for traffic prioritization and bandwidth reservation. This mechanism must enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

b
The router must have IP source routing disabled.
SC-7 - Medium - CCI-002403 - V-55773 - SV-70027r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000195-RTR-000084
Vuln IDs
  • V-55773
Rule IDs
  • SV-70027r1_rule
Source routing is a feature of IP, whereby individual packets can specify routes. This feature is used in several different network attacks by bypassing perimeter and internal defense mechanisms.
Checks: C-56339r1_chk

Review the configuration to determine if source routing is enabled. If source routing is enabled, this is a finding.

Fix: F-60643r1_fix

Configure the router to disable IP source routing.

b
The router must restrict BGP connections to known IP addresses of neighbor routers from trusted Autonomous Systems (AS).
SC-7 - Medium - CCI-002403 - V-55775 - SV-70029r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000195-RTR-000086
Vuln IDs
  • V-55775
Rule IDs
  • SV-70029r1_rule
Advertisement of routes by an Autonomous System for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes a DoS on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could redistribute Interior Gateway Protocol routes into Border Gateway Protocol, thereby leaking internal routes.
Checks: C-56341r1_chk

Review the router configuration to verify that Border Gateway Protocol connections are only from known neighbors in a trusted AS by restricting TCP port 179 to specific IP addresses. If the router is not configured to restrict TCP port 179 to specific IP addresses, this is a finding.

Fix: F-60645r1_fix

Configure an ingress filter to block any unauthorized BGP connection attempts by restricting TCP port 179 to specific IP addresses (authorized BGP peers).

b
The router must configure the maximum hop limit value to at least 32.
SC-7 - Medium - CCI-001097 - V-55777 - SV-70031r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-001097
Version
SRG-NET-000205-RTR-000108
Vuln IDs
  • V-55777
Rule IDs
  • SV-70031r1_rule
The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message to be used by hosts instead of the standardized default value. If a very small value was configured and advertised to hosts on the LAN segment, communications would fail due to the hop limit reaching zero before the packets sent by a host reached their destination.
Checks: C-56343r1_chk

Review the router configuration to determine if the maximum hop limit has been configured. If it has been configured, then it must be set to at least 32. If it has not been configured, it must be determined what the default value is. If the default value is below 32 and the maximum hop limit value has not been configured (set to at least 32), this is a finding. In any case, maximum hop limit must be at least 32.

Fix: F-60647r1_fix

Configure the router maximum hop limit value to at least 32.

b
The router must stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort.
SC-24 - Medium - CCI-001190 - V-55779 - SV-70033r1_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001190
Version
SRG-NET-000235-RTR-000114
Vuln IDs
  • V-55779
Rule IDs
  • SV-70033r1_rule
Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. Network elements that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes. If the router fails in an unsecure manner (open), unauthorized traffic originating externally to the enclave may enter, or the device may permit unauthorized information release. Fail secure is a condition achieved by employing information system mechanisms to ensure, in the event of a device initialization failure, device shutdown failure, or an abort failure of the router, it does not enter into an unsecure state where intended security properties no longer hold. If the device fails, it must not fail in a manner that will allow unauthorized access. If the router fails for any reason, it must stop forwarding traffic altogether or maintain the configured security policies. If the device stops forwarding traffic, maintaining network availability would be achieved through device redundancy. Since it is usually not possible to test this capability in a production environment, systems should either be validated in a testing environment or prior to installation. This requirement is usually a function of the design of the router component. Compliance can be verified by acceptance/validation processes or vendor attestation.
Checks: C-56345r1_chk

Verify the router stops forwarding traffic or maintains the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort. If the router does not stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort, this is a finding.

Fix: F-60649r1_fix

Configure the router to stop forwarding traffic or maintain the configured security policies upon the failure of the following actions: system initialization, shutdown, or system abort.

b
The router must protect against or limit the effects of denial of service (DoS) attacks by employing control plane protection.
SC-5 - Medium - CCI-002385 - V-55781 - SV-70035r1_rule
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
SRG-NET-000362-RTR-000110
Vuln IDs
  • V-55781
Rule IDs
  • SV-70035r1_rule
The Route Processor (RP) is critical to all network operations because it is the component used to build all forwarding paths for the data plane via control plane processes. It is also instrumental with ongoing network management functions that keep the routers and links available for providing network services. Any disruption to the Route Processor or the control and management planes can result in mission-critical network outages. A DoS attack targeting the Route Processor can result in excessive CPU and memory utilization. To maintain network stability and Route Processor security, the router must be able to handle specific control plane and management plane traffic that is destined to the Route Processor. In the past, one method of filtering was to use ingress filters on forwarding interfaces to filter both forwarding path and receiving path traffic. However, this method does not scale well as the number of interfaces grows and the size of the ingress filters grow. Control plane policing increases the security of routers and multilayer switches by protecting the Route Processor from unnecessary or malicious traffic. Filtering and rate limiting the traffic flow of control plane packets can be implemented to protect routers against reconnaissance and DoS attacks, allowing the control plane to maintain packet forwarding and protocol states despite an attack or heavy load on the router or multilayer switch.
Checks: C-56347r1_chk

Determine whether control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class. If the router does not have control plane protection implemented, this is a finding.

Fix: F-60651r1_fix

Implement control plane protection by classifying traffic types based on importance and configure filters to restrict and rate limit the traffic directed to and processed by the route processor according to each class.

b
The router must only allow incoming communications from authorized sources to be routed to authorized destinations.
SC-7 - Medium - CCI-002403 - V-55785 - SV-70039r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-002403
Version
SRG-NET-000364-RTR-000109
Vuln IDs
  • V-55785
Rule IDs
  • SV-70039r1_rule
Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Traffic can be restricted directly by an ACL (which is a firewall function) or by Policy Routing. Policy Routing is a technique used to make routing decisions based on a number of different criteria other than just the destination network, including source or destination network, source or destination address, source or destination port, protocol, packet size, and packet classification. This overrides the router's normal routing procedures used to control the specific paths of network traffic. It is normally used for traffic engineering, but can also be used to meet security requirements; for example, traffic that is not allowed can be routed to the Null0 or discard interface. Policy Routing can also be used to control which prefixes appear in the routing table. Traffic can be restricted directly by an ACL (which is a firewall function), or by Policy Routing. This requirement is intended to allow network administrators the flexibility to use whatever technique is most effective.
Checks: C-56355r2_chk

Review the router configuration to determine if the router only allows incoming communications from authorized sources to be routed to authorized destinations. If the router does not restrict incoming communications to allow only authorized sources and destinations, this is a finding.

Fix: F-60659r1_fix

Configure the router to only allow incoming communications from authorized sources to be routed to authorized destinations.

b
The router must fail securely in the event of an operational failure.
SC-7 - Medium - CCI-001126 - V-55789 - SV-70043r1_rule
RMF Control
SC-7
Severity
M
CCI
CCI-001126
Version
SRG-NET-000365-RTR-000112
Vuln IDs
  • V-55789
Rule IDs
  • SV-70043r1_rule
If the router fails in an unsecure manner (open), unauthorized traffic originating externally to the enclave may enter, or the device may permit unauthorized information release. Fail secure is a condition achieved by employing information system mechanisms to ensure, in the event of an operational failure of the router, it does not enter into an unsecure state where intended security properties no longer hold. If the device fails, it must not fail in a manner that will allow unauthorized access. If the router fails for any reason, it must stop forwarding traffic altogether or maintain the configured security policies. If the device stops forwarding traffic, maintaining network availability would be achieved through device redundancy.
Checks: C-56357r1_chk

Review the documentation of the router or interview the System Administrator. Verify that the router fails securely in the event of an operational failure. If it cannot, this is a finding.

Fix: F-60661r1_fix

This is a capability that would be intrinsic to the router as a result of its development and may not be configurable. If it is a configurable option, configure the device to fail securely in the event of an operational failure.

b
The router must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including NSA configuration guides, Communications Tasking Orders (CTOs), and Directive-Type Memorandums (DTMs).
CM-6 - Medium - CCI-000366 - V-55791 - SV-70045r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
SRG-NET-000512-RTR-000113
Vuln IDs
  • V-55791
Rule IDs
  • SV-70045r1_rule
If the router does not follow established security guidance, it is likely that it is not adequately secured, which increases the risk. Configuring the router to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those information system components to meet operational requirements. Typically, an equipment vendor provides their product on an appliance with an embedded operating system (either a modified version of a common operating system or a proprietary operating system) and other application and/or database code. To minimize risk, a router must use a secure or hardened platform and comply with all applicable configuration guidance.
Checks: C-56359r1_chk

Review the configuration of the router and verify that it is configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance. This may involve interviewing the System Administrators, ISSM or personnel designated by the ISSM, and the program's Configuration Management personnel. If it is not configured in accordance with DoD security configuration or implementation guidance, this is a finding.

Fix: F-60663r1_fix

Configure the router in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including NSA configuration guides, CTOs, and DTMs. Follow local change management processes when implementing configuration changes.