STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

DISA Rule

SV-217083r639663_rule

Vulnerability Number

V-217083

Group Title

SRG-NET-000019-RTR-000004

Rule Version

JUNI-RT-000790

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DoDIN Backbone.

Configure neighbor filters to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor filters to all PIM enabled interfaces.

Configure prefix list for each neighbor.

[edit policy-options]
set prefix-list PIM_NBR1 x.x.x.x/32
set prefix-list PIM_NBR2 x.x.x.x/32
set prefix-list PIM_NBR3 x.x.x.x/32

Configure policy statements for each PIM neighbor.

[edit policy-options]
set policy-statement PIM_NBR1_POLICY from prefix-list PIM_NBR1
set policy-statement PIM_NBR1_POLICY then accept
set policy-statement PIM_NBR2_POLICY from prefix-list PIM_NBR1
set policy-statement PIM_NBR2_POLICY then accept
set policy-statement PIM_NBR3_POLICY from prefix-list PIM_NBR1
set policy-statement PIM_NBR3_POLICY then accept

Apply the neighbor policy to all interfaces enabled for PIM.

[edit protocols pim]
set interface ge-1/0/1.0 neighbor-policy PIM_NBR1_POLICY
set interface ge-1/1/1.0 neighbor-policy PIM_NBR1_POLICY
set interface ge-2/1/0.0 neighbor-policy PIM_NBR1_POLICY

Check Contents

This requirement is not applicable for the DoDIN Backbone.

Verify all interfaces enabled for PIM have a neighbor filter bound to the interface as shown in the example below.

protocols {
…
…
…
pim {
interface ge-1/0/1.0 {
mode sparse;
neighbor-policy PIM_NBR1_POLICY;
}
interface ge-1/1/1.0 {
mode sparse;
neighbor-policy PIM_NBR2_POLICY;
}
interface ge-2/1/0.0 {
mode sparse;
neighbor-policy PIM_NBR3_POLICY;
}
}

Review the prefix list and policy statements configured for filtering PIM neighbors as shown in the example below.

policy-options {
prefix-list PIM_NBR1 {
x.x.x.x/32;
}
prefix-list PIM_NBR2 {
x.x.x.x/32;
}
prefix-list PIM_NBR3 {
x.x.x.x/32;
}

policy-statement PIM_NBR1_POLICY {
from {
prefix-list PIM_NBR1;
}
then accept;
}
policy-statement PIM_NBR2_POLICY {
from {
prefix-list PIM_NBR2;
}
then accept;
}
policy-statement PIM_NBR3_POLICY {
from {
prefix-list PIM_NBR3;
}
then accept;
}

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Vulnerability Number

V-217083

Documentable

False

Rule Version

JUNI-RT-000790

Severity Override Guidance

This requirement is not applicable for the DoDIN Backbone.

Verify all interfaces enabled for PIM have a neighbor filter bound to the interface as shown in the example below.

protocols {
…
…
…
pim {
interface ge-1/0/1.0 {
mode sparse;
neighbor-policy PIM_NBR1_POLICY;
}
interface ge-1/1/1.0 {
mode sparse;
neighbor-policy PIM_NBR2_POLICY;
}
interface ge-2/1/0.0 {
mode sparse;
neighbor-policy PIM_NBR3_POLICY;
}
}

Review the prefix list and policy statements configured for filtering PIM neighbors as shown in the example below.

policy-options {
prefix-list PIM_NBR1 {
x.x.x.x/32;
}
prefix-list PIM_NBR2 {
x.x.x.x/32;
}
prefix-list PIM_NBR3 {
x.x.x.x/32;
}

policy-statement PIM_NBR1_POLICY {
from {
prefix-list PIM_NBR1;
}
then accept;
}
policy-statement PIM_NBR2_POLICY {
from {
prefix-list PIM_NBR2;
}
then accept;
}
policy-statement PIM_NBR3_POLICY {
from {
prefix-list PIM_NBR3;
}
then accept;
}

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Check Content Reference

M

Target Key

4032

Comments