NET.3.1 Routers and Switches

Prior to using a router or switch, it MUST be configured securely. All configuration changes SHOULD be documented in a transparent manner. The integrity of the configuration files MUST be protected appropriately. Before access passwords are stored, they MUST be secured using an up-to-date cryptographic method (see CON.1 Crypto Concept).

Routers and switches MUST be configured in such a way that only absolutely necessary services, protocols, and functional extensions are used. Services, protocols, and functional extensions that are not required MUST be disabled or uninstalled completely. Unused interfaces on routers and switches MUST also be disabled. If possible, unused network ports MUST be disabled or at least assigned to an unassigned VLAN set up for this purpose.

If functional extensions are used, the security policies of the organisation in question MUST continue to be met. The use of such extensions SHOULD also be justified and documented.

Information on internal configurations and operating statuses MUST be hidden from third parties. Unnecessary information services MUST be disabled.

All administration and management access to routers and switches MUST be restricted to individual source IP addresses or address ranges. It MUST be ensured that it is not possible to access the administration interfaces directly from untrusted networks.

Suitably encrypted protocols SHOULD be used to administer and monitor routers and switches. If unencrypted protocols are nevertheless used, a separate administration network (out-of-band management) MUST be used for administration. The management interfaces and administration connections MUST be protected by means of a separate firewall. Appropriate time limits MUST be specified for the interfaces (e.g. for timeouts).

All services not required for management interfaces MUST be disabled. If a network component has a dedicated hardware interface, any unauthorised access to this interface MUST be prevented appropriately.

Protection mechanisms MUST be enabled on routers and layer 3 switches in order to fend off IPv4 and IPv6 fragmentation attacks.

Administrators MUST always be capable of directly accessing routers and switches to ensure continuous administration even if an entire network fails.

A router or switch MUST be configured in such a way that it logs the following events, among others:

• configuration changes (automatically whenever possible)
• reboots
• system errors
• Status changes for each interface, system, and network segment
• Login errors

The configuration files of routers and switches MUST be backed up at regular intervals. The backup copies MUST be created in such a way that they can be accessed in an emergency.

The most important operational tasks of a router or switch MUST be documented appropriately. All configuration changes and security-relevant tasks SHOULD be documented. The documentation SHOULD be protected against unauthorised access.

A specific security policy MUST be drawn up for routers and switches based on the general security policy of the organisation in question. This security policy SHOULD transparently describe the requirements and specifications for the secure operation of routers and switches. The policy SHOULD be known to all administrators and be integral to their work. If the policy is changed or deviations from the agreed requirements are allowed, this SHOULD be coordinated with the CISO and documented. It SHOULD be checked regularly whether the policy is still being properly implemented. The results SHOULD be documented appropriately.

Prior to procuring routers and switches, a requirements list SHOULD be drawn up based on the relevant security policy that can be used to evaluate the products available on the market. It SHOULD be ensured that the desired security level of the organisation in question can be achieved with the devices to be procured. The procurement process SHOULD thus be based on the requirements of the aforementioned security policy.

A configuration checklist SHOULD be created that can be used to check the most important security-relevant settings on routers and switches. Since secure configurations strongly depend on the purpose at hand, the different requirements of these devices SHOULD be taken into consideration within the framework of the configuration checklist.

Routers and switches SHOULD only be administered via a separate management network (out-of-band management). Any administration interface available via the actual data network at hand (in-band) SHOULD be disabled. The available security mechanisms of the management protocols used for authentication, integrity assurance, and encryption SHOULD be activated. All insecure management protocols SHOULD be disabled.

The protocols ICMP and ICMPv6 SHOULD be filtered restrictively.

Attackers SHOULD be prevented from entering routers and switches with the help of forged, reserved, or unassigned IP addresses.

When using IPv6, mechanisms SHOULD be used to detect and prevent attacks on the type-0 routing header.

Mechanisms SHOULD be used that detect and fend off high-volume attacks and TCP state exhaustion attacks.

Access to routers and switches SHOULD be defined with the help of access control lists (ACLs). Based on the security policy of the organisation in question, the ACL SHOULD define which IT systems or networks (and corresponding methods) may be used to access a router or switch. If there are no specific rules, a restrictive whitelist approach SHOULD be preferred as a matter of principle.

The ports of a switch SHOULD be protected against unauthorised access.

Routers SHOULD authenticate themselves when exchanging routing information or transmitting updates for routing tables. Only routing protocols that support this SHOULD be used.

Dynamic routing protocols SHOULD only be used in secure networks. They MUST NOT be used in demilitarised zones (DMZs). In DMZs, static routes SHOULD be entered instead.

Routers and switches SHOULD be connected to a central identity and authorisation management system (see ORP.4 Identity and Access Management).

There SHOULD be planning and preparation for the errors in routers or switches that can be diagnosed in an emergency. There SHOULD also be planning and preparation regarding how to remedy the errors identified. Appropriate actions SHOULD be defined for typical failure scenarios and updated at regular intervals.

The contingency planning for routers and switches SHOULD be coordinated with overarching fault and contingency planning. The contingency planning SHOULD be based on the general contingency planning concept at hand (see DER.4 Business Continuity Management). It SHOULD be ensured that contingency planning documentation and the instructions it contains are available in paper form. The procedure described in the contingency planning concept SHOULD be tested regularly.

Routers and switches SHOULD be checked for known security issues at regular intervals. Audits SHOULD also be performed regularly. This SHOULD include checking whether the actual situation corresponds to the basic configuration defined as secure. The results SHOULD be clearly documented and compared against the target situation. Deviations SHOULD be investigated.

Port-based access control according to IEEE 802.1x SHOULD be implemented on the basis of EAP-TLS. Implementations according to the standards IEEE 802.1x-2001 and IEEE 802.1x-2004 SHOULD NOT be performed.

If a router or switch crashes, it SHOULD be ensured that no legacy or incorrect configurations (including ACLs) are used when recovering and restarting the device.

The implementation of a high-availability solution SHOULD NOT impair the operation of routers and switches or their security features, or reduce the level of security. Routers and switches SHOULD be designed redundantly. In so doing, it SHOULD be ensured that the security policy of the organisation in question is observed.

Routers and switches SHOULD include and use features that can detect applications and prioritise bandwidths.

Routers and switches with a Common Criteria security evaluation of at least EAL4 SHOULD be used.