The router must be configured so that rotating keys are not used for authenticating IGP peers that have a duration exceeding 180 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000025-RTR-000085	SRG-NET-000025-RTR-000085	SRG-NET-000025-RTR-000085_rule		Medium

Description
If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000025-RTR-000085_chk )
Review key expiration dates. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day expiration dates. If two rotating keys with overlapping expiration dates, both with 180-day expiration dates are not configured, this is a finding.

Fix Text (F-SRG-NET-000025-RTR-000085_fix)
Configure the router to utilize two rotating keys with overlapping expiration dates, both with 180-day expiration dates for routing protocol authentication.