The network element must authenticate devices before establishing network connections using bidirectional authentication between cryptographically based devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000151-IDPS-000138	SRG-NET-000151-IDPS-000138	SRG-NET-000151-IDPS-000138_rule		Medium

Description
An IDPS must have a level of trust with any node wanting to connect to it. The remote node could be a host device requiring a layer 2 connection to the network or a router wanting to peer as a neighbor and establish a connection to exchange control plane and forwarding plane traffic. A network control plane is comprised of routing, signaling, and link management protocols; all used to establish the forwarding paths required by the data plane. Disrupting the flow of this information or injecting false information breaks down the integrity or believability of path information. To safeguard these connections it is imperative the connecting device authenticate itself prior to granting access. In the case of peering neighbors, the authentication must be bidirectional. Regardless of the paradigm, authentication must use a form of cryptography to ensure a high level of trust and authenticity.

Description

An IDPS must have a level of trust with any node wanting to connect to it. The remote node could be a host device requiring a layer 2 connection to the network or a router wanting to peer as a neighbor and establish a connection to exchange control plane and forwarding plane traffic. A network control plane is comprised of routing, signaling, and link management protocols; all used to establish the forwarding paths required by the data plane. Disrupting the flow of this information or injecting false information breaks down the integrity or believability of path information. To safeguard these connections it is imperative the connecting device authenticate itself prior to granting access. In the case of peering neighbors, the authentication must be bidirectional. Regardless of the paradigm, authentication must use a form of cryptography to ensure a high level of trust and authenticity.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43276_chk )
Verify sensor communications to wireless network elements (e.g., sensors, management consoles, routers, syslog servers, and forensics servers) are configured to establish mutual authentication before establishing communications. If communications between the IDPS and network elements is not mutually authenticated, this is a finding.

Fix Text (F-43276_fix)
Configure the IDPS to require mutual authentication when communicating with other network elements.