Ensure 'BGP authentication' is enabled

HighLevel 2Automatedcisco-asa

Description

BGP is an inter and intra autonomous system routing protocol. An autonomous system is a network or group of networks under a common administration and with common routing policies. BGP is used to exchange routing information for the Internet and is the protocol used between Internet service providers (ISP). Customer networks, such as universities and corporations, usually employ an Interior Gateway Protocol (IGP) such as OSPF for the exchange of routing information within their networks. Passes when BGP is not configured; otherwise fails if no BGP neighbor has a 'password'. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

How it is checked

Audit method: Configuration pattern

Pattern: (?m)\A(?:(?:[ \t]*(?:$|[^n \t\n]|n(?:$|[^e\n]|e(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^h\n]|h(?:$|[^b\n]|b(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^ \n])))))))))[^\n]*|[ \t]*neighbor (?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*)))))))))[ \t]+)*(?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*))))))))))?)\n)*router bgp [^\n]*(?:\n(?:(?:[ \t]*(?:$|[^n \t\n]|n(?:$|[^e\n]|e(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^h\n]|h(?:$|[^b\n]|b(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^ \n])))))))))[^\n]*|[ \t]*neighbor (?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*)))))))))[ \t]+)*(?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*))))))))))?)))*\n?\z

How it is fixed

Fix method: Guidance or infrastructure patch

! Step 1 Enable BGP. Step 2 Define the Best Path for a BGP Routing Process. Step 3 Configure Policy Lists. Step 4 Configure AS Path Filters. Step 5 Configure Community Rules. Step 6 Configure IPv4 Address Family Settings. Step 7 Configure IPv6 Address Family Settings. router bgp 2 bgp default local-preference 500 policy-list Example-policy-list1 permit as-path access-list 35 permit testaspath community-list standard excomm1 permit 100 internet no-advertise no-export bgp router-id 10.86.118.3 ciscoasa(config-router-af) aggregate-address 10.86.118.0 255.255.255.0 as-set summary-only suppress-map example1 advertise-map example1 attribute-map example1

Properties

Operating systems: Any
Tags: cisco-asanetworkaaa
Reference: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 2.1.3 Ensure 'BGP authentication' is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cisco-asa --level 2