Ensure peer authentication is set to IPSEC SA (BGP)

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

CIS assessment: Manual. Due to the range of options for configuring IPSEC SA based Authentication with BGP, this recommendation is not scorable.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

! To setup IPSEC SA based authentication, first configure a Security Association at the hierarchy; edit security-association <SA name> set description <description> set mode transport set manual direction bidirectional protocol ah set manual direction bidirectional authentication algorithm <authentication method> set manual direction bidirectional authentication key <key> The SA must be bi-directional and must be configured with the same parameters on all neighbors reachable on the intended interface. Note that only Authenticated Header is configured in this example which provides mutual authentication but does not encrypt BGP protocol messages in transit. To configure IPSEC SA based authentication globally for BGP, issue the following command from the hierarchy; set protocols bgp ipsec-sa To configure IPSEC SA based authentication for a group, issue the following command from the hierarchy; set protocols bgp group <group name> ipsec-sa <SA name> To configure IPSEC SA based authentication for a neighbor, issue the following command from the hierarchy; set protocols bgp group <group name> neighbor <neighbor ip address> ipsec-sa <SA name>