II - Mission Support Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The BGP router must be configured to use its loopback address as the source address for iBGP peering sessions.
<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability o...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The MPLS router must be configured to use its loopback address as the source address for LDP peering sessions.
<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability o...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The MPLS router must be configured to synchronize IGP and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.
<VulnDiscussion>Packet loss can occur when an IGP adjacency is established and the router begins forwarding packets using the new adjacency b...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The MPLS router must be configured to have TTL Propagation disabled.
<VulnDiscussion>The head end of the label-switched path (LSP), the label edge router (LER) will decrement the IP packet's time-to-live (TTL) ...Rule Medium Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.
<VulnDiscussion>The primary security model for an MPLS L3VPN infrastructure is traffic separation. The service provider must guarantee the cu...Rule High Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).
<VulnDiscussion>The primary security model for an MPLS L3VPN as well as a VRF-lite infrastructure is traffic separation. Each interface can o...Rule High Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router must be configured to have each VRF with the appropriate Route Distinguisher (RD).
<VulnDiscussion>An RD provides uniqueness to the customer address spaces within the MPLS L3VPN infrastructure. The concept of the VPN-IPv4 an...Rule Medium Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router providing MPLS Virtual Private Wire Service (VPWS) must be configured to have the appropriate virtual circuit identification (VC ID) for each attachment circuit.
<VulnDiscussion>VPWS is an L2VPN technology that provides a virtual circuit between two PE routers to forward Layer 2 frames between two cust...Rule High Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.
<VulnDiscussion>VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer Layer 2 frames are for...Rule High Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The PE router must be configured to enforce the split-horizon rule for all pseudowires within a Virtual Private LAN Services (VPLS) bridge domain.
<VulnDiscussion>A virtual forwarding instance (VFI) must be created on each participating PE router for each customer VLAN using VPLS for car...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The Multicast Source Discovery Protocol (MSDP) router must be configured to use its loopback address as the source address when originating MSDP traffic.
<VulnDiscussion>Using a loopback address as the source address offers a multitude of uses for security, access, management, and scalability o...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The router must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
<VulnDiscussion>Configuring the network device to implement organization-wide security implementation guides and security checklists ensures ...Rule Medium Severity -
SRG-NET-000131
<GroupDescription></GroupDescription>Group -
The router must not be configured to have any feature enabled that calls home to the vendor.
<VulnDiscussion>Call home services will routinely send data such as configuration and diagnostic information to the vendor for routine or eme...Rule Medium Severity -
SRG-NET-000205
<GroupDescription></GroupDescription>Group -
The perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).
<VulnDiscussion>A compromised host in an enclave can be used by a malicious platform to launch cyber attacks on third parties. This is a comm...Rule High Severity -
SRG-NET-000205
<GroupDescription></GroupDescription>Group -
The perimeter router must be configured to block all packets with any IP options.
<VulnDiscussion>Packets with IP options are not fast switched and henceforth must be punted to the router processor. Hackers who initiate den...Rule Medium Severity -
SRG-NET-000205
<GroupDescription></GroupDescription>Group -
The PE router must be configured to ignore or block all packets with any IP options.
<VulnDiscussion>Packets with IP options are not fast switched and therefore must be punted to the router processor. Hackers who initiate deni...Rule Medium Severity -
SRG-NET-000230
<GroupDescription></GroupDescription>Group -
The router must be configured to implement message authentication for all control plane protocols.
<VulnDiscussion>A rogue router could send a fictitious routing update to convince a site's perimeter router to send traffic to an incorrect o...Rule Medium Severity -
SRG-NET-000230
<GroupDescription></GroupDescription>Group -
The BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.
<VulnDiscussion>If the same keys are used between eBGP neighbors, the chance of a hacker compromising any of the BGP sessions increases. It i...Rule Medium Severity -
SRG-NET-000230
<GroupDescription></GroupDescription>Group -
The router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.
<VulnDiscussion>If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by...Rule Medium Severity -
SRG-NET-000362
<GroupDescription></GroupDescription>Group -
The BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
<VulnDiscussion>GTSM is designed to protect a router's IP-based control plane from DoS attacks. Many attacks focused on CPU load and line-car...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.
<VulnDiscussion>The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being ...Rule Low Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The router must not be configured to use IPv6 Site Local Unicast addresses.
<VulnDiscussion>As currently defined, site local addresses are ambiguous and can be present in multiple sites. The address itself does not co...Rule Medium Severity -
SRG-NET-000512
<GroupDescription></GroupDescription>Group -
The perimeter router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.
<VulnDiscussion>Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. To mitigat...Rule Medium Severity -
SRG-NET-000364
<GroupDescription></GroupDescription>Group -
The perimeter router must be configured to drop IPv6 undetermined transport packets.
<VulnDiscussion>One of the fragmentation weaknesses known in IPv6 is the undetermined transport packet. This packet contains an undetermined ...Rule Medium Severity -
SRG-NET-000364
<GroupDescription></GroupDescription>Group -
The perimeter router must be configured drop IPv6 packets with a Routing Header type 0, 1, or 3255.
<VulnDiscussion>The routing header can be used maliciously to send a packet through a path where less robust security is in place, rather tha...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.