STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper perimeter router must be configured to block all outbound management traffic.

DISA Rule

SV-217043r639663_rule

Vulnerability Number

V-217043

Group Title

SRG-NET-000364-RTR-000113

Rule Version

JUNI-RT-000380

Severity

CAT II

CCI(s)

• CCI-001097 - The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system.

Weight

10

Fix Recommendation

This requirement is not applicable for the DoDIN Backbone.

Configure the perimeter router of the managed network with an outbound filter on the egress interface to block all management traffic.

Configure a filter to block egress management traffic.

[edit firewall family inet]
Set filter OUTBOUND_FILTER term BLOCK_TACACS from protocol tcp port tacacs
Set filter OUTBOUND_FILTER term BLOCK_TACACS then syslog discard
Set filter OUTBOUND_FILTER term BLOCK_SNMP from protocol udp port [snmp snmptrap]
Set filter OUTBOUND_FILTER term BLOCK_SNMP then syslog discard
set filter OUTBOUND_FILTER term BLOCK_NETFLOW from protocol udp port [2055 9995 9996]
set filter OUTBOUND_FILTER term BLOCK_NETFLOW then syslog discard

Configure the external interfaces with the outbound filter.

[edit interfaces ge-0/0/0 unit 0 family inet]
set filter output OUTBOUND_FILTER

Check Contents

This requirement is not applicable for the DoDIN Backbone.

The perimeter router of the managed network must be configured with an outbound filter on the egress interface to block all management traffic as shown in the example below.

Verify that the router has been configured with an outbound filter as shown in the example below.

interfaces {
description "NIPRNet";
ge-0/0/0 {
unit 0 {
family inet {
no-redirects;
filter {
output OUTBOUND_FILTER;
}
address 10.1.12.2/24;
}
}
}

Verify that the outbound filter discard or rejects management traffic as shown in the example below.

firewall {
family inet {
…
…
…
}
filter OUTBOUND_FILTER {
term BLOCK_TACACS {
from {
protocol tcp;
port tacacs;
}
then {
syslog;
discard;
}
}
term BLOCK_SNMP {
from {
protocol udp;
port [ snmp snmptrap ];
}
then {
syslog;
discard;
}
}
term BLOCK_NETFLOW {
from {
protocol udp;
port [ 2055 9995 9996 ];
}
}
term ALLOW_OTHER {
then accept;
}
}
}

If management traffic is not blocked at the perimeter, this is a finding.

Vulnerability Number

V-217043

Documentable

False

Rule Version

JUNI-RT-000380

Severity Override Guidance

This requirement is not applicable for the DoDIN Backbone.

The perimeter router of the managed network must be configured with an outbound filter on the egress interface to block all management traffic as shown in the example below.

Verify that the router has been configured with an outbound filter as shown in the example below.

interfaces {
description "NIPRNet";
ge-0/0/0 {
unit 0 {
family inet {
no-redirects;
filter {
output OUTBOUND_FILTER;
}
address 10.1.12.2/24;
}
}
}

Verify that the outbound filter discard or rejects management traffic as shown in the example below.

firewall {
family inet {
…
…
…
}
filter OUTBOUND_FILTER {
term BLOCK_TACACS {
from {
protocol tcp;
port tacacs;
}
then {
syslog;
discard;
}
}
term BLOCK_SNMP {
from {
protocol udp;
port [ snmp snmptrap ];
}
then {
syslog;
discard;
}
}
term BLOCK_NETFLOW {
from {
protocol udp;
port [ 2055 9995 9996 ];
}
}
term ALLOW_OTHER {
then accept;
}
}
}

If management traffic is not blocked at the perimeter, this is a finding.

Check Content Reference

M

Target Key

4032

Comments