STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.

DISA Rule

SV-223206r539624_rule

Vulnerability Number

V-223206

Group Title

SRG-APP-000516-NDM-000336

Rule Version

JUSX-DM-000095

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000370 - The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.

Weight

10

Fix Recommendation

Configure the Juniper SRX to support the use of AAA services to centrally manage user authentication and logon settings. To completely set up AAA authentication, use a user template account (the default name is remote) and specify a system authentication server and an authentication order.

[edit]
set system tacplus-server address <server ipaddress> port 1812 secret <shared secret>

or

[edit]
set system radius-server address <server ipaddress> port 1812 secret <shared secret>

Note: DoD policy is that redundant AAA servers are required to mitigate the risk of a failure of the primary AAA device. Also see CCI-000213 for further details.

Check Contents

Verify the Juniper SRX is configured to support the use of AAA services to centrally manage user authentication and logon settings.

From the CLI operational mode enter:
show system radius-server
or
show system tacplus-server

If the Juniper SRX has not been configured to support the use RADIUS and/or TACACS+ servers to centrally manage authentication and logon settings for remote and nonlocal access, this is a finding.

Vulnerability Number

V-223206

Documentable

False

Rule Version

JUSX-DM-000095

Severity Override Guidance

Verify the Juniper SRX is configured to support the use of AAA services to centrally manage user authentication and logon settings.

From the CLI operational mode enter:
show system radius-server
or
show system tacplus-server

If the Juniper SRX has not been configured to support the use RADIUS and/or TACACS+ servers to centrally manage authentication and logon settings for remote and nonlocal access, this is a finding.

Check Content Reference

M

Target Key

4098

Comments