What changed in Juniper Router RTR STIG V3R2V3R2 changes

Title

The Juniper perimeter router must be configured to protect an enclave connected to an alternateapproved gateway by using an inbound filter that only permits packets with destination addresses within the sitessite's address space.

Check text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. Verify the interface connecting to the ISP has an inbound filter as shown in the example below. interfaces { ge-0/0/0 { description "Verizon ISP link"; unit 0 { family inet { filter { input ISP_FILTER; } address 11.1.12.2/24; } } } Verify that the filter only allows traffic to specific destination addresses (i.e., enclave’s NIPRNet address space) as shown in the example below. firewall { family inet { filter ISP_FILTER { term RESTRICT_DESTINATION { from { destination-address { 0.0.0.0/0; 11.1.0.0/16 except; } } then { syslog; discard; } } term ALLOW_XYZ { from { protocol xyz; } then accept; } … … … term DENY_ALL_OTHER { then { syslog; reject; } } } If the ingress filter bound to the interface connecting to an alternateapproved gateway permits packets with addresses other than those specified, such as destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternateapproved gateway network service provider, this is a finding.

Fix text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. Configure the ingress filter of the perimeter router connected to an alternateapproved gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternateapproved gateway network service provider as shown in the example below. [edit firewall family inet filter ISP_FILTER] set term RESTRICT_DESTINATION from destination-address 0.0.0.0/0 set term RESTRICT_DESTINATION from destination-address 11.1.0.0/16 except set term RESTRICT_DESTINATION then syslog discard insert term RESTRICT_DESTINATION before term ALLOW_XYZ

Discussion

Enclaves with alternateapproved gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's alternate gateway, the perimeter router could be routing transit data from the Internetinternet into the NIPRNet. This could also make the perimeter router vulnerable to a denial-of-service (DoS) attack asand well as provide a back door into the NIPRNet. The DoDDOD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approvedapproved Gatewaygateway is secure through filters permitting packets with a destination address belonging to the DoDDOD enclave's address block.

V-217033 in V3R2

Title

The Juniper perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an altepprnatoved gateway service provider.

Check text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. Review the protocols hierarchy in the router configuration (see example below) and verify there are no BGP neighbors are configured to a peer AS that belongs to the alternateapproved gateway service provider. protocols { bgp { group AS_2 { type external; peer-as 2; neighbor x.x.x.x { authentication-algorithm hmac-sha-1-96; authentication-key-chain BGP_KEY; } neighbor x.x.x.x { authentication-algorithm hmac-sha-1-96; authentication-key-chain BGP_KEY; } } } If there are BGP neighbors are connecting to a peer AS of the alternateapproved gateway service provider, this is a finding.

Fix text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. Configure a static route on the perimeter router to reach the AS of a router connecting to an alternateapproved gateway as shown in the example below. [edit routing-options] set static route 0.0.0.0/0 next-hop x.x.x.x

Discussion

Internet service providers (ISPs) use BGP to share route information with other autonomous systems (i.e., other ISPs and corporate networks). If the perimeter router was configured to BGP peer with an ISP, NIPRNet routes could be advertised to the ISP;, thereby creating a backdoor connection from the Internetinternet to the NIPRNet.

V-217034 in V3R2

Check text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. The perimeter router of the managed network must be configured with an outbound filter on the egress interface to block all management traffic as shown in the example below. Verify that the router has been configured with an outbound filter as shown in the example below. interfaces { description "NIPRNet"; ge-0/0/0 { unit 0 { family inet { no-redirects; filter { output OUTBOUND_FILTER; } address 10.1.12.2/24; } } } Verify that the outbound filter discarddiscards or rejects management traffic as shown in the example below. firewall { family inet { … … … } filter OUTBOUND_FILTER { term BLOCK_TACACS { from { protocol tcp; port tacacs; } then { syslog; discard; } } term BLOCK_SNMP { from { protocol udp; port [ snmp snmptrap ]; } then { syslog; discard; } } term BLOCK_NETFLOW { from { protocol udp; port [ 2055 9995 9996 ]; } then { syslog; discard; } } term ALLOW_OTHER { then accept; } } } If management traffic is not blocked at the perimeter, this is a finding.

Fix text

This requirement is not applicable for the DoDINDODIN Backbonebackbone. Configure the perimeter router of the managed network with an outbound filter on the egress interface to block all management traffic. Configure a filter to block egress management traffic. [edit firewall family inet] Set filter OUTBOUND_FILTER term BLOCK_TACACS from protocol tcp port tacacs Set filter OUTBOUND_FILTER term BLOCK_TACACS then syslog discard Set filter OUTBOUND_FILTER term BLOCK_SNMP from protocol udp port [snmp snmptrap] Set filter OUTBOUND_FILTER term BLOCK_SNMP then syslog discard set filter OUTBOUND_FILTER term BLOCK_NETFLOW from protocol udp port [2055 9995 9996] set filter OUTBOUND_FILTER term BLOCK_NETFLOW then syslog discard Configure the external interfaces with the outbound filter. [edit interfaces ge-0/0/0 unit 0 family inet] set filter output OUTBOUND_FILTER

Discussion

For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.

V-217043 in V3R2

Check text

This requirement is not applicable for the DODIN Backbonebackbone. Review the network topology diagram to determine connectivity between the managed network and the NOC. Review the OOBM gateway router configuration to validate the path and interface that the management traffic traverses. If an IPsec tunnel is used to transport the management traffic between the NOC and the managed network, review the configuration following the steps below. Review the security association within the IPsec configuration to be used for encapsulating the management traffic and verify that it is in tunnel mode. Also note the security association to be used. security { ipsec { proposal IPSEC_PHASE2_PROPOSAL { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm aes-128-cbc; } policy IPSEC_POLICY { perfect-forward-secrecy { keys group14; } proposals IPSEC_PHASE2_PROPOSAL; } security-association IPSEC-SA_XYZ { description "For XYZ"; mode transport; manual { direction bidirectional { protocol ah; spi 256; authentication { algorithm hmac-sha1-96; key ascii-text "$8$oPJjH.P5F69mSHqPQn6u0RhSreW-dsZGi8XYoZDmP"; ## SECRET-DATA } } } } security-association IPSEC_SA_MGMT { description "IPsec Tunnel for Mgmt Traffic"; mode tunnel; dynamic { ipsec-policy IPSEC_POLICY; } } } ike { proposal IKE_PHASE1_PROPOSAL { authentication-method pre-shared-keys; dh-group group14; authentication-algorithm sha-256; encryption-algorithm aes-128256-cbc; } policy 10.1.25.2 { mode main; proposals IKE_PHASE1_PROPOSAL; pre-shared-key ascii-text "$8$J4UDkCA01IcHqEy"; ## SECRET-DATA } } Verify there is a filter to direct the management traffic to the IPsec tunnel by verifying the name of the IPsec SA referenced in the then statement as shown in the example below. firewall { family inet { … … … filter MGMT_TRAFFIC { term ALLOW_SNMP { from { protocol udp; port [ snmp snmptrap ]; } then ipsec-sa IPSEC_SA_MGMT; } term ALLOW_TACACS { from { protocol tcp; port tacacs; } then ipsec-sa IPSEC_SA_MGMT; } term ALLOW_NETFLOW { from { protocol udp; port [ 2055 9995 9996 ]; } then ipsec-sa IPSEC_SA_MGMT; } term OTHER { then accept; } } } If management traffic is not transported between the managed network and the NOC via dedicated circuit, MPLS/VPN service, or IPsec tunnel, this is a finding.

Fix text

This requirement is not applicable for the DODIN Backbonebackbone. Ensure that a dedicated circuit, MPLS/VPN service, or IPsec tunnel is deployed to transport management traffic between the managed network and the NOC. If an IPsec tunnel is to be used, the steps below can be used as a guideline. Configure an IPsec tunnel using commands similar to the example below. [edit security] set ike proposal IKE_PHASE1_PROPOSAL authentication-method pre-shared-keys set ike proposal IKE_PHASE1_PROPOSAL authentication-algorithm sha-256 set ike proposal IKE_PHASE1_PROPOSAL dh-group group14 set ike proposal IKE_PHASE1_PROPOSAL encryption-algorithm aes-128256-cbc set ike policy 10.1.25.2 proposals IKE_PHASE1_PROPOSAL set ike policy 10.1.25.2 mode main set ike policy 10.1.25.2 pre-shared-key ascii-text xxxxxxxxx set ipsec proposal IPSEC_PHASE2_PROPOSAL protocol esp set ipsec proposal IPSEC_PHASE2_PROPOSAL authentication-algorithm hmac-sha1-96 set ipsec proposal IPSEC_PHASE2_PROPOSAL encryption-algorithm aes-128256-cbc set ipsec security-association IPSEC_SA_MGMT mode tunnel set ipsec security-association IPSEC_SA_MGMT dynamic ipsec-policy IPSEC_POLICY Configure a filter to define the management traffic to be forwarded into the IPsec tunnel. [edit firewall family inet] set filter MGMT_TRAFFIC term ALLOW_SNMP from protocol udp port [snmp snmptrap] set filter MGMT_TRAFFIC term ALLOW_SNMP then ipsec-sa IPSEC_SA_MGMT set filter MGMT_TRAFFIC term ALLOW_TACACS from protocol tcp port tacacs set filter MGMT_TRAFFIC term ALLOW_TACACS then ipsec-sa IPSEC_SA_MGMT set filter MGMT_TRAFFIC term ALLOW_NETFLOW from protocol udp port [2055 9995 9996] set filter MGMT_TRAFFIC term ALLOW_NETFLOW then ipsec-sa IPSEC_SA_MGMT set filter MGMT_TRAFFIC term OTHER then accept

V-217044 in V3R2