Ensure 'BGP authentication' is enabled

AltaNivel 2Automatizadacisco-asa

Descripción

BGP is an inter and intra autonomous system routing protocol. An autonomous system is a network or group of networks under a common administration and with common routing policies. BGP is used to exchange routing information for the Internet and is the protocol used between Internet service providers (ISP). Customer networks, such as universities and corporations, usually employ an Interior Gateway Protocol (IGP) such as OSPF for the exchange of routing information within their networks. Passes when BGP is not configured; otherwise fails if no BGP neighbor has a 'password'. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)\A(?:(?:[ \t]*(?:$|[^n \t\n]|n(?:$|[^e\n]|e(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^h\n]|h(?:$|[^b\n]|b(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^ \n])))))))))[^\n]*|[ \t]*neighbor (?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*)))))))))[ \t]+)*(?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*))))))))))?)\n)*router bgp [^\n]*(?:\n(?:(?:[ \t]*(?:$|[^n \t\n]|n(?:$|[^e\n]|e(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^h\n]|h(?:$|[^b\n]|b(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^ \n])))))))))[^\n]*|[ \t]*neighbor (?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*)))))))))[ \t]+)*(?:(?:[^p \t\n][^ \t\n]*|p(?:|[^a \t\n][^ \t\n]*|a(?:|[^s \t\n][^ \t\n]*|s(?:|[^s \t\n][^ \t\n]*|s(?:|[^w \t\n][^ \t\n]*|w(?:|[^o \t\n][^ \t\n]*|o(?:|[^r \t\n][^ \t\n]*|r(?:|[^d \t\n][^ \t\n]*|d(?:[^ \t\n][^ \t\n]*))))))))))?)))*\n?\z

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! Step 1 Enable BGP. Step 2 Define the Best Path for a BGP Routing Process. Step 3 Configure Policy Lists. Step 4 Configure AS Path Filters. Step 5 Configure Community Rules. Step 6 Configure IPv4 Address Family Settings. Step 7 Configure IPv6 Address Family Settings. router bgp 2 bgp default local-preference 500 policy-list Example-policy-list1 permit as-path access-list 35 permit testaspath community-list standard excomm1 permit 100 internet no-advertise no-export bgp router-id 10.86.118.3 ciscoasa(config-router-af) aggregate-address 10.86.118.0 255.255.255.0 as-set summary-only suppress-map example1 advertise-map example1 attribute-map example1

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-asanetworkaaa
Referencia: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 2.1.3 Ensure 'BGP authentication' is enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-asa --level 2