Ensure peer authentication is set to IPSEC SA (BGP)

ÉlevéeNiveau 2Revue manuellejuniper-junos

Description

BGP Neighbors should be strongly authenticated. Where it is deployed, BGP routing is vital for normal operation of an organization's network infrastructure. Correct route information is required for routers to correctly direct traffic through the network. CIS assessment: Manual. Reported as SKIP with review instructions.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

CIS assessment: Manual. Due to the range of options for configuring IPSEC SA based Authentication with BGP, this recommendation is not scorable.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

! To setup IPSEC SA based authentication, first configure a Security Association at the hierarchy; edit security-association <SA name> set description <description> set mode transport set manual direction bidirectional protocol ah set manual direction bidirectional authentication algorithm <authentication method> set manual direction bidirectional authentication key <key> The SA must be bi-directional and must be configured with the same parameters on all neighbors reachable on the intended interface. Note that only Authenticated Header is configured in this example which provides mutual authentication but does not encrypt BGP protocol messages in transit. To configure IPSEC SA based authentication globally for BGP, issue the following command from the hierarchy; set protocols bgp ipsec-sa To configure IPSEC SA based authentication for a group, issue the following command from the hierarchy; set protocols bgp group <group name> ipsec-sa <SA name> To configure IPSEC SA based authentication for a neighbor, issue the following command from the hierarchy; set protocols bgp group <group name> neighbor <neighbor ip address> ipsec-sa <SA name>

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: juniper-junosnetworkaaa
Référence: CIS Juniper OS Benchmark v2.1.0 - 4.1.2 Ensure peer authentication is set to IPSEC SA