Detections
Analytics

3.2.1 BGP Authentication

Information

The neighbor password command enables authentication on a TCP connection with a BGP peer

When utilizing BGP the threat profile becomes much larger as routes external to the data center will be updating routing information in the devices. Much like with the IGP an attacker could redirect traffic to an insecure location where traffic could be analyzed and confidential information extracted. In the case of BGP a peer AS can send erroneous prefix information and as a result could allow packets to be sent to an insecure network. It is recommended that peer authentication be used for all peers. A password or key should be defined for each BGP neighbor regardless of the peer's autonomous system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure passwords for each neighbor as appropriate

router bgp
 neighbor {IP address} password

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1)

Plugin: Arista

Control ID: 71bf1d86aea2f6dfeb27f49e68ce1f0ed7ee7209f17b4c612bbdb3df3ff914b6