Ensure peer authentication is set to IPSEC SA (BGP)

高レベル 2手動レビューjuniper-junos

説明

BGP Neighbors should be strongly authenticated. Where it is deployed, BGP routing is vital for normal operation of an organization's network infrastructure. Correct route information is required for routers to correctly direct traffic through the network. CIS assessment: Manual. Reported as SKIP with review instructions.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

CIS assessment: Manual. Due to the range of options for configuring IPSEC SA based Authentication with BGP, this recommendation is not scorable.

修正方法

修正方法: ガイダンスまたは IaC パッチ

! To setup IPSEC SA based authentication, first configure a Security Association at the hierarchy; edit security-association <SA name> set description <description> set mode transport set manual direction bidirectional protocol ah set manual direction bidirectional authentication algorithm <authentication method> set manual direction bidirectional authentication key <key> The SA must be bi-directional and must be configured with the same parameters on all neighbors reachable on the intended interface. Note that only Authenticated Header is configured in this example which provides mutual authentication but does not encrypt BGP protocol messages in transit. To configure IPSEC SA based authentication globally for BGP, issue the following command from the hierarchy; set protocols bgp ipsec-sa To configure IPSEC SA based authentication for a group, issue the following command from the hierarchy; set protocols bgp group <group name> ipsec-sa <SA name> To configure IPSEC SA based authentication for a neighbor, issue the following command from the hierarchy; set protocols bgp group <group name> neighbor <neighbor ip address> ipsec-sa <SA name>

プロパティ

オペレーティングシステム: すべて
タグ: juniper-junosnetworkaaa
参照: CIS Juniper OS Benchmark v2.1.0 - 4.1.2 Ensure peer authentication is set to IPSEC SA