The Juniper BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254026	JUEX-RT-000540	SV-254026r844111_rule		Medium

Description
If the same keys are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It is possible that a malicious user exists in one autonomous system who would know the key used for the eBGP session. This user would then be able to hijack BGP sessions with other trusted neighbors.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2023-03-23

Details

Check Text ( C-57478r844109_chk )
Interview the ISSM and router administrator to determine if unique keys are being used. [edit security ipsec] security-association { manual { direction bidirectional { protocol esp; spi ; authentication { algorithm hmac-sha-256-128; key ascii-text "$8$aes256-gcm$hmac-sha2-256$100$SpJ/ERRFEsc$y1Wqf1zM3d3xI+ZVB9WzTw$lgM06LJZN3FcVbTaSkDz4g$bZVi57MkUWg"; ## SECRET-DATA } } } } [edit protocols bgp] group { type external; local-as ; neighbor { authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA } neighbor { ipsec-sa ; } } Note: Juniper BGP routers support either an MD5 key, rotating MD5 keys, or an IPsec security association (SA). Verify the PSK for each MD5 and SA is different between all neighbors. If unique keys are not being used, this is a finding.

Check Text ( C-57478r844109_chk )

Interview the ISSM and router administrator to determine if unique keys are being used.

[edit security ipsec]
security-association {
manual {
direction bidirectional {
protocol esp;
spi ;
authentication {
algorithm hmac-sha-256-128;
key ascii-text "$8$aes256-gcm$hmac-sha2-256$100$SpJ/ERRFEsc$y1Wqf1zM3d3xI+ZVB9WzTw$lgM06LJZN3FcVbTaSkDz4g$bZVi57MkUWg"; ## SECRET-DATA
}
}
}
}
[edit protocols bgp]
group {
type external;
local-as ;
neighbor {
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$cFQ99Gy83Og$SCMVXvnfna7/cZqH9fCECQ$bCVokm+es94xFJONmbKFNA$4561Uc/r"; ## SECRET-DATA
}
neighbor {
ipsec-sa ;
}
}

Note: Juniper BGP routers support either an MD5 key, rotating MD5 keys, or an IPsec security association (SA). Verify the PSK for each MD5 and SA is different between all neighbors.

If unique keys are not being used, this is a finding.

Fix Text (F-57429r844110_fix)
Configure all eBGP routers with unique keys for each eBGP neighbor that it peers with. set security ipsec security-association manual direction bidirectional protocol esp set security ipsec security-association manual direction bidirectional spi set security ipsec security-association manual direction bidirectional authentication algorithm hmac-sha-256-128 set security ipsec security-association manual direction bidirectional authentication key ascii-text set protocols bgp group type external set protocols bgp group local-as set protocols bgp group neighbor authentication-key set protocols bgp group neighbor ipsec-sa test

Fix Text (F-57429r844110_fix)

Configure all eBGP routers with unique keys for each eBGP neighbor that it peers with.

set security ipsec security-association manual direction bidirectional protocol esp
set security ipsec security-association manual direction bidirectional spi
set security ipsec security-association manual direction bidirectional authentication algorithm hmac-sha-256-128
set security ipsec security-association manual direction bidirectional authentication key ascii-text

set protocols bgp group type external
set protocols bgp group local-as
set protocols bgp group neighbor authentication-key
set protocols bgp group neighbor ipsec-sa test