Details
If the keys used for routing protocol authentication are guessed, the malicious user could create havoc within the network by advertising incorrect routes and redirecting traffic. Changing the keys frequently reduces the risk of them eventually being guessed. When configuring authentication for routing protocols that provide key chains, configure two rotating keys with overlapping expiration dates, both with 180-day or less expirations.
Solution
Configure the device so rotating keys expire at 180 days or less.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Cisco.
References
- 800-53|IA-3.
- CAT|III
- Rule-ID|SV-15301r4_rule
- STIG-ID|NET0422
- Vuln-ID|V-14667