STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to use FIPS 140-2/140-3-validated algorithms for authentication to a cryptographic module.

DISA Rule

SV-253911r1167978_rule

Vulnerability Number

V-253911

Group Title

SRG-APP-000179-NDM-000265

Rule Version

JUEX-NM-000340

Severity

CAT I

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure the password format, SSH algorithms, and the RNG to use only FIPS-validated algorithms.
1. Enter configuration mode.
2. Configure the password format.
3. Configure the SSH algorithms.
4. Configure the RNG.
5. Commit the configuration.
user@host> configure
user@host# set system login password format <sha256|sha512>
user@host# set system services ssh ciphers aes256-ctr
user@host# set system services ssh ciphers aes256-cbc
user@host# set system services ssh macs hmac-sha2-512
user@host# set system services ssh macs hmac-sha2-256
user@host# set system services ssh key-exchange ecdh-sha2-nistp521
user@host# set system services ssh key-exchange ecdh-sha2-nistp384
user@host# set system services ssh key-exchange ecdh-sha2-nistp256
user@host# set system rng hmac-drbg
user@host# commit

Check Contents

Verify the password format, and that SSH uses FIPS-validated algorithms and a random number generator (RNG) as shown in the following example configuration:

user@host> show configuration system
login {
password {
:
format <sha256|sha-512>;
}
}
services {
ssh {
:
ciphers [ aes256-ctr aes256-cbc];
macs [ hmac-sha2-512 hmac-sha2-256 ];
key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ];
:
}
}
rng {
hmac-drbg;
}

If the network device is not configured to use FIPS 140-2/140-3-validated authentication algorithms, this is a finding.

Vulnerability Number

V-253911

Documentable

False

Rule Version

JUEX-NM-000340

Severity Override Guidance

Verify the password format, and that SSH uses FIPS-validated algorithms and a random number generator (RNG) as shown in the following example configuration:

user@host> show configuration system
login {
password {
:
format <sha256|sha-512>;
}
}
services {
ssh {
:
ciphers [ aes256-ctr aes256-cbc];
macs [ hmac-sha2-512 hmac-sha2-256 ];
key-exchange [ ecdh-sha2-nistp521 ecdh-sha2-nistp384 ecdh-sha2-nistp256 ];
:
}
}
rng {
hmac-drbg;
}

If the network device is not configured to use FIPS 140-2/140-3-validated authentication algorithms, this is a finding.

Check Content Reference

M

Target Key

5477