STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

DISA Rule

SV-217047r639663_rule

Vulnerability Number

V-217047

Group Title

SRG-NET-000019-RTR-000012

Rule Version

JUNI-RT-000420

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DoDIN Backbone.

Remove the configuration that imports routes from the management network into the managed network or vice versa as shown in the example below.

[edit routing-options]
delete rib-groups INET0_GROUP
delete interface-routes rib-group inet INET0_GROUP

Check Contents

This requirement is not applicable for the DoDIN Backbone.

Verify the Interior Gateway Protocol (IGP) instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports routes from the global route table (inet.0) in the route table for the management VRF.

}
routing-options {
interface-routes {
rib-group inet INET0_GROUP;
}
rib-groups {
INET0_GROUP {
import-rib [ VRF_MGMT.inet.0 inet.0 ];
}
}
}

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Vulnerability Number

V-217047

Documentable

False

Rule Version

JUNI-RT-000420

Severity Override Guidance

This requirement is not applicable for the DoDIN Backbone.

Verify the Interior Gateway Protocol (IGP) instance used for the managed network does not redistribute routes into the IGP instance used for the management network, and vice versa. The example below imports routes from the global route table (inet.0) in the route table for the management VRF.

}
routing-options {
interface-routes {
rib-group inet INET0_GROUP;
}
rib-groups {
INET0_GROUP {
import-rib [ VRF_MGMT.inet.0 inet.0 ];
}
}
}

If the IGP instance used for the managed network redistributes routes into the IGP instance used for the management network, or vice versa, this is a finding.

Check Content Reference

M

Target Key

4032

Comments