Juniper PTX10008 Admin Guide

Category
Networking
Type
Admin Guide

This manual is also suitable for

Junos® OS
Published
2023-05-11
RELEASE
20.3X75-D30
Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
Junos® OS
20.3X75-D30
Copyright © 2023 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
ii
Table of Contents
1
Overview
Understanding Junos OS in FIPS Mode | 2
Understanding FIPS Terminology and Supported Cryptographic Algorithms | 4
Idenfying Secure Product Delivery | 6
Understanding Management Interfaces | 8
2
Conguring Administrave Credenals and Privileges
Understanding the Associated Password Rules for an Authorized Administrator | 10
3
Conguring Roles and Authencaon Methods
Understanding Roles and Services for Junos OS | 13
Understanding the Operaonal Environment for Junos OS in FIPS Mode | 15
Understanding Password Specicaons and Guidelines for Junos OS in FIPS Mode | 19
Downloading Soware Packages from Juniper Networks | 21
Installing Soware on a Device with Single Roung Engine | 21
Understanding Zeroizaon to Clear System Data for FIPS Mode | 24
Zeroizing the System | 25
Enabling FIPS Mode | 27
Conguring Crypto Ocer and FIPS User Idencaon and Access | 29
Conguring Crypto Ocer Access | 29
Conguring FIPS User Login Access | 31
4
Conguring SSH and Console Connecon
Conguring SSH on the Evaluated Conguraon for FIPS | 34
5
Conguring MACsec
Understanding Media Access Control Security (MACsec) in FIPS mode | 37
iii
Conguring MACsec | 38
Customizing Time | 38
Conguring MACsec on a Device Running Junos OS | 39
Conguring Stac MACsec with ICMP Trac | 40
Conguring MACsec with keychain using ICMP Trac | 44
Conguring Stac MACsec for Layer 2 Trac | 51
Conguring MACsec with keychain for Layer 2 Trac | 56
6
Conguring Event Logging
Event Logging Overview | 66
Conguring Event Logging to a Local File | 67
Interpreng Event Messages | 67
Logging Changes to Secret Data | 69
Login and Logout Events Using SSH | 69
Logging of Audit Startup | 70
7
Performing Self-Tests on a Device
Understanding FIPS Self-Tests | 72
Example: Congure FIPS Self-Tests | 72
Hardware and Soware Requirements | 73
Overview | 73
Conguraon | 74
Vericaon | 75
Verifying the FIPS Self-Test | 75
8
Operaonal Commands
request system zeroize | 80
request vmhost zeroize no-forwarding | 81
iv
About This Guide
Use this guide to operate PTX10008 and PTX10016 devices in Federal Informaon Processing
Standards (FIPS) 140-2 Level 1 environment. FIPS 140-2 denes security levels for hardware and
soware that perform cryptographic funcons.
RELATED DOCUMENTATION
Common Criteria and FIPS Cercaons
v
1
CHAPTER
Overview
Understanding Junos OS in FIPS Mode | 2
Understanding FIPS Terminology and Supported Cryptographic Algorithms | 4
Idenfying Secure Product Delivery | 6
Understanding Management Interfaces | 8
Understanding Junos OS in FIPS Mode
IN THIS SECTION
Supported Plaorms and Hardwares | 2
About the Cryptographic Boundary on Your Device | 2
How FIPS Mode Diers from Non-FIPS Mode | 3
Validated Version of Junos OS in FIPS Mode | 3
Federal Informaon Processing Standards (FIPS) 140-2 denes security levels for hardware and soware
that perform cryptographic funcons. This Juniper Networks router running the Juniper Networks Junos
operang system (Junos OS) in
FIPS mode
comply with the FIPS 140-2 Level 1 standard.
Operang this router in a FIPS 140-2 Level 1 environment requires enabling and conguring FIPS mode
on the devices from the Junos OS command-line interface (CLI).
The Crypto Ocer enables FIPS mode in Junos OS and sets up keys and passwords for the system and
other
FIPS users
.
Supported Plaorms and Hardwares
For the features described in this document, the following plaorms are used to qualify FIPS
cercaon:
PTX10008 and PTX10016 devices installed with RE-PTX-2X00x4, and LC1101 and LC1102 (hps://
www.juniper.net/us/en/products/routers/ptx-series/ptx10000-ptx10004-ptx10008-and-ptx10016-
packet-transport-routers.html).
About the Cryptographic Boundary on Your Device
FIPS 140-2 compliance requires a dened
cryptographic boundary
around each
cryptographic module
on a device. Junos OS in FIPS mode prevents the cryptographic module from execung any soware
that is not part of the FIPS-cered distribuon, and allows only FIPS-approved cryptographic
2
algorithms to be used. No crical security parameters (CSPs), such as passwords and keys, can cross the
cryptographic boundary of the module in unencrypted format.
CAUTION: Virtual Chassis features are not supported in FIPS mode. Do not congure a
Virtual Chassis in FIPS mode.
How FIPS Mode Diers from Non-FIPS Mode
Junos OS in FIPS mode diers in the following ways from Junos OS in non-FIPS mode:
Self-tests of all cryptographic algorithms are performed at startup.
Self-tests of random number and key generaon are performed connuously.
Weak cryptographic algorithms such as Data Encrypon Standard (DES) and MD5 are disabled.
Weak or unencrypted management connecons must not be congured.
Passwords must be encrypted with strong one-way algorithms that do not permit decrypon.
Administrator passwords must be at least 10 characters long.
Validated Version of Junos OS in FIPS Mode
To determine whether a Junos OS release is NIST-validated, see the compliance adviser page on the
Juniper Networks Web site (hps://apps.juniper.net/compliance/).
RELATED DOCUMENTATION
Idenfying Secure Product Delivery | 6
3
Understanding FIPS Terminology and Supported
Cryptographic Algorithms
IN THIS SECTION
Terminology | 4
Supported Cryptographic Algorithms | 5
Use the denions of FIPS terms, and supported algorithms to help you understand Junos OS in FIPS
mode.
Terminology
Crical security
parameter (CSP)
Security-related informaon—for example, secret and private cryptographic keys and
authencaon data such as passwords and personal idencaon numbers (PINs)—
whose disclosure or modicaon can compromise the security of a cryptographic
module or the informaon it protects. For details, see "Understanding the
Operaonal Environment for Junos OS in FIPS Mode" on page 15.
Cryptographic
module
The set of hardware, soware, and rmware that implements approved security
funcons (including cryptographic algorithms and key generaon) and is contained
within the cryptographic boundary.
FIPS Federal Informaon Processing Standards. FIPS 140-2 species requirements for
security and cryptographic modules. Junos OS in FIPS mode complies with FIPS
140-2 Level 1.
FIPS
maintenance
role
The role the Crypto Ocer assumes to perform physical maintenance or logical
maintenance services such as hardware or soware diagnoscs. For FIPS 140-2
compliance, the Crypto Ocer zeroizes the Roung Engine on entry to and exit from
the FIPS maintenance role to erase all plain-text secret and private keys and
unprotected CSPs.
4
NOTE: The FIPS maintenance role is not supported on Junos OS in FIPS
mode.
KATs Known answer tests. System self-tests that validate the output of cryptographic
algorithms approved for FIPS and test the integrity of some Junos OS modules. For
details, see "Understanding FIPS Self-Tests" on page 72.
SSH A protocol that uses strong authencaon and encrypon for remote access across a
nonsecure network. SSH provides remote login, remote program execuon, le copy,
and other funcons. It is intended as a secure replacement for rlogin, rsh, and rcp in a
UNIX environment. To secure the informaon sent over administrave connecons,
use SSHv2 for CLI conguraon. In Junos OS, SSHv2 is enabled by default, and
SSHv1, which is not considered secure, is disabled.
Zeroizaon Erasure of all CSPs and other user-created data on a device before its operaon as a
FIPS cryptographic module or in preparaon for repurposing the devices for non-
FIPS operaon. The Crypto Ocer can zeroize the system with a CLI operaonal
command.
Supported Cryptographic Algorithms
BEST PRACTICE: For FIPS 140-2 compliance, use only FIPS-approved cryptographic
algorithms In Junos OS in FIPS mode.
The following cryptographic algorithms are supported in FIPS mode. Symmetric methods use the same
key for encrypon and decrypon, while asymmetric methods use dierent keys for encrypon and
decrypon.
AES The Advanced Encrypon Standard (AES), dened in FIPS PUB 197. The AES algorithm
uses keys of 128, 192, or 256 bits to encrypt and decrypt data in blocks of 128 bits.
ECDH Ellipc Curve Die-Hellman. A variant of the Die-Hellman key exchange algorithm that
uses cryptography based on the algebraic structure of ellipc curves over nite elds.
ECDH allows two pares, each having an ellipc curve public-private key pair, to establish
a shared secret over an insecure channel. The shared secret can be used either as a key or
5
to derive another key for encrypng subsequent communicaons using a symmetric key
cipher.
ECDSA Ellipc Curve Digital Signature Algorithm. A variant of the Digital Signature Algorithm
(DSA) that uses cryptography based on the algebraic structure of ellipc curves over nite
elds. The bit size of the ellipc curve determines the diculty of decrypng the key. The
public key believed to be needed for ECDSA is about twice the size of the security level, in
bits. ECDSA using the P-256, P-384, and P-521 curves can be congured under OpenSSH.
HMAC Dened as “Keyed-Hashing for Message Authencaon” in RFC 2104, HMAC combines
hashing algorithms with cryptographic keys for message authencaon. For Junos OS in
FIPS mode, HMAC uses the iterated cryptographic hash funcons SHA-1, SHA-256, and
SHA-512 along with a secret key.
SHA-256
and
SHA-512
Secure hash algorithms (SHA) belonging to the SHA-2 standard dened in FIPS PUB
180-2. Developed by NIST, SHA-256 produces a 256-bit hash digest, and SHA-512
produces a 512-bit hash digest.
3DES
(3des-cbc)
Encrypon standard based on the original Data Encrypon Standard (DES) from the 1970s
that used a 56-bit key and was cracked in 1997. The more secure 3DES is DES enhanced
with three mulple stages and eecve key lengths of about 112 bits. For Junos OS in
FIPS mode, 3DES is implemented with cipher block chaining (CBC).
RELATED DOCUMENTATION
Understanding FIPS Self-Tests | 72
Understanding Zeroizaon to Clear System Data for FIPS Mode | 24
Idenfying Secure Product Delivery
There are several mechanisms provided in the delivery process to ensure that a customer receives a
product that has not been tampered with. The customer should perform the following checks upon
receipt of a device to verify the integrity of the plaorm.
Shipping label—Ensure that the shipping label correctly idenes the correct customer name and
address as well as the device.
6
Outside packaging—Inspect the outside shipping box and tape. Ensure that the shipping tape has not
been cut or otherwise compromised. Ensure that the box has not been cut or damaged to allow
access to the device.
Inside packaging—Inspect the plasc bag and seal. Ensure that the bag is not cut or removed. Ensure
that the seal remains intact.
If the customer idenes a problem during the inspecon, he or she should immediately contact the
supplier. Provide the order number, tracking number, and a descripon of the idened problem to the
supplier.
Addionally, there are several checks that can be performed to ensure that the customer has received a
box sent by Juniper Networks and not a dierent company masquerading as Juniper Networks. The
customer should perform the following checks upon receipt of a device to verify the authencity of the
device:
Verify that the device was ordered using a purchase order. Juniper Networks devices are never
shipped without a purchase order.
When a device is shipped, a shipment nocaon is sent to the e-mail address provided by the
customer when the order is taken. Verify that this e-mail nocaon was received. Verify that the e-
mail contains the following informaon:
Purchase order number
Juniper Networks order number used to track the shipment
Carrier tracking number used to track the shipment
List of items shipped including serial numbers
Address and contacts of both the supplier and the customer
Verify that the shipment was iniated by Juniper Networks. To verify that a shipment was iniated
by Juniper Networks, you should perform the following tasks:
Compare the carrier tracking number of the Juniper Networks order number listed in the Juniper
Networks shipping nocaon with the tracking number on the package received.
Log on to the Juniper Networks online customer support portal at hps://support.juniper.net/
support/ to view the order status. Compare the carrier tracking number or the Juniper Networks
order number listed in the Juniper Networks shipment nocaon with the tracking number on
the package received.
7
Understanding Management Interfaces
The following management interfaces can be used in the evaluated conguraon:
Local Management Interfaces—The RJ-45 console port on the device is congured as RS-232 data
terminal equipment (DTE). You can use the command-line interface (CLI) over this port to congure
the device from a terminal.
Remote Management Protocols—The device can be remotely managed over any Ethernet interface.
SSHv2 is the only permied remote management protocol that can be used in the evaluated
conguraon. The remote management protocols J-Web and Telnet are not available for use on the
device.
8
2
CHAPTER
Conguring Administrave
Credenals and Privileges
Understanding the Associated Password Rules for an Authorized Administrator |
10
Understanding the Associated Password Rules for
an Authorized Administrator
The authorized administrator is associated with a dened login class, and the administrator is assigned
with all permissions. Data is stored locally for xed password authencaon.
NOTE: Do not use control characters in passwords.
Use the following guidelines and conguraon opons for passwords and when selecng passwords for
authorized administrator accounts. Passwords should be:
Easy to remember so that users are not tempted to write it down.
Changed periodically.
Private and not shared with anyone.
Contain a minimum of 10 characters. The minimum password length is 10 characters.
[ edit ]
administrator@host# set system login password minimum-length 10
Include both alphanumeric and punctuaon characters, composed of any combinaon of upper and
lowercase leers, numbers, and special characters such as, “!”, “@”, “#”, “$”, “%”, “^”, “&, “*”, “(“, and “)”.
There should be at least a change in one case, one or more digits, and one or more punctuaon
marks.
Contain character sets. Valid character sets include uppercase leers, lowercase leers, numbers,
punctuaon, and other special characters.
[ edit ]
administrator@host# set system login password change-type character-sets
10
Contain the minimum number of character sets or character set changes. The minimum number of
character sets required in plain-text passwords in Junos FIPS is 3.
[ edit ]
administrator@host# set system login password minimum-changes 3
The hashing algorithm for user passwords can be either SHA256 or SHA512 (SHA512 is the default
hashing algorithm).
[ edit ]
administrator@host# set system login password format sha512
NOTE: The device supports ECDSA (P-256, P-384, and P-521) and RSA (2048, 3072, and 4092
modulus bit length) key-types.
Weak passwords are:
Words that might be found in or exist as a permuted form in a system le such as /etc/passwd.
The hostname of the system (always a rst guess).
Any words appearing in a diconary. This includes diconaries other than English, and words found
in works such as Shakespeare, Lewis Carroll, Roget's Thesaurus, and so on. This prohibion includes
common words and phrases from sports, sayings, movies, and television shows.
Permutaons on any of the above. For example, a diconary word with vowels replaced with digits
(for example f00t) or with digits added to the end.
Any machine-generated passwords. Algorithms reduce the search space of password-guessing
programs and so should not be used.
Strong reusable passwords can be based on leers from a favorite phrase or word, and then
concatenated with other, unrelated words, along with addional digits and punctuaon.
RELATED DOCUMENTATION
Idenfying Secure Product Delivery | 6
11
3
CHAPTER
Conguring Roles and Authencaon
Methods
Understanding Roles and Services for Junos OS | 13
Understanding the Operaonal Environment for Junos OS in FIPS Mode | 15
Understanding Password Specicaons and Guidelines for Junos OS in FIPS
Mode | 19
Downloading Soware Packages from Juniper Networks | 21
Installing Soware on a Device with Single Roung Engine | 21
Understanding Zeroizaon to Clear System Data for FIPS Mode | 24
Zeroizing the System | 25
Enabling FIPS Mode | 27
Conguring Crypto Ocer and FIPS User Idencaon and Access | 29
Understanding Roles and Services for Junos OS
IN THIS SECTION
Crypto Ocer Role and Responsibilies | 14
FIPS User Role and Responsibilies | 14
What Is Expected of All FIPS Users | 15
The Security Administrator is associated with the dened login class security-admin, which has the
necessary permission set to permit the administrator to perform all tasks necessary to manage Junos
OS. Administrave users (Security Administrator) must provide unique idencaon and authencaon
data before any administrave access to the system is granted.
Security Administrator roles and responsibilies are as follows:
1. Security Administrator can administer locally and remotely.
2. Create, modify, delete administrator accounts, including conguraon of authencaon failure
parameters.
3. Re-enable an Administrator account.
4. Responsible for the conguraon and maintenance of cryptographic elements related to the
establishment of secure connecons to and from the evaluated product.
The Juniper Networks Junos operang system (Junos OS) running in non-FIPS mode allows a wide range
of capabilies for users, and authencaon is identy-based. In contrast, the FIPS 140-2 standard
denes two user roles: Crypto Ocer and FIPS user. These roles are dened in terms of Junos OS user
capabilies.
All other user types dened for Junos OS in FIPS mode (operator, administrave user, and so on) must
fall into one of the two categories: Crypto Ocer or FIPS user. For this reason, user authencaon in
FIPS mode is role-based rather than identy-based.
Crypto Ocer performs all FIPS-mode-related conguraon tasks and issue all statements and
commands for Junos OS in FIPS mode. Crypto Ocer and FIPS user conguraons must follow the
guidelines for Junos OS in FIPS mode.
13
Crypto Ocer Role and Responsibilies
The Crypto Ocer is the person responsible for enabling, conguring, monitoring, and maintaining
Junos OS in FIPS mode on a device. The Crypto Ocer securely installs Junos OS on the device, enables
FIPS mode, establishes keys and passwords for other users and soware modules, and inializes the
device before network connecon.
BEST PRACTICE: We recommend that the Crypto Ocer administer the system in a secure
manner by keeping passwords secure and checking audit les.
The permissions that disnguish the Crypto Ocer from other FIPS users are secret, security, maintenance,
and control. For FIPS compliance, assign the Crypto Ocer to a login class that contains all of these
permissions. A user with the Junos OS maintenance permission can read les containing crical security
parameters (CSPs).
NOTE: Junos OS in FIPS mode does not support the FIPS 140-2 maintenance role, which is
dierent from the Junos OS maintenance permission.
Among the tasks related to Junos OS in FIPS mode, the Crypto Ocer is expected to:
Set the inial root password. The length of the password should be at least 10 characters.
Reset user passwords with FIPS-approved algorithms.
Examine log and audit les for events of interest.
Erase user-generated les, keys, and data by zeroizing the device.
FIPS User Role and Responsibilies
All FIPS users, including the Crypto Ocer, can view the conguraon. Only the user assigned as the
Crypto Ocer can modify the conguraon.
The permissions that disnguish Crypto Ocers from other FIPS users are secret, security, maintenance,
and control. For FIPS compliance, assign the FIPS user to a class that contains none of these
permissions.
FIPS user can view status output but cannot reboot or zeroize the device.
14
What Is Expected of All FIPS Users
All FIPS users, including the Crypto Ocer, must observe security guidelines at all mes.
All FIPS users must:
Keep all passwords condenal.
Store devices and documentaon in a secure area.
Deploy devices in secure areas.
Check audit les periodically.
Conform to all other FIPS 140-2 security rules.
Follow these guidelines:
Users are trusted.
Users abide by all security guidelines.
Users do not deliberately compromise security.
Users behave responsibly at all mes.
RELATED DOCUMENTATION
Zeroizing the System | 25
Understanding the Operaonal Environment for
Junos OS in FIPS Mode
IN THIS SECTION
Hardware Environment for Junos OS in FIPS Mode | 16
Soware Environment for Junos OS in FIPS Mode | 16
Crical Security Parameters | 17
15
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60
  • Page 61 61
  • Page 62 62
  • Page 63 63
  • Page 64 64
  • Page 65 65
  • Page 66 66
  • Page 67 67
  • Page 68 68
  • Page 69 69
  • Page 70 70
  • Page 71 71
  • Page 72 72
  • Page 73 73
  • Page 74 74
  • Page 75 75
  • Page 76 76
  • Page 77 77
  • Page 78 78
  • Page 79 79
  • Page 80 80
  • Page 81 81
  • Page 82 82
  • Page 83 83
  • Page 84 84
  • Page 85 85
  • Page 86 86
  • Page 87 87
  • Page 88 88

Juniper PTX10008 Admin Guide

Category
Networking
Type
Admin Guide
This manual is also suitable for

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI