STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to synchronize internal information system clocks using redundant authoritative time sources.

DISA Rule

SV-253920r1018769_rule

Vulnerability Number

V-253920

Group Title

SRG-APP-000373-NDM-000298

Rule Version

JUEX-NM-000430

Severity

CAT II

CCI(s)

• CCI-004928 - Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.
• CCI-004922 - Synchronize system clocks within and between systems or system components.
• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.

Weight

10

Fix Recommendation

Configure the network device to synchronize internal information system clocks with the primary and secondary time sources.

set system ntp authentication-key 1 type sha256
set system ntp authentication-key 1 value "PSK"
set system ntp authentication-key 2 type sha1
set system ntp authentication-key 2 value "PSK"
set system ntp server <address 1> key 1
set system ntp server <address 1> prefer
set system ntp server <address 2> key 2
set system ntp trusted-key 1
set system ntp trusted-key 2
set system ntp source-address <lo0 or OOBM address>

Check Contents

Determine if the network device is configured to synchronize internal information system clocks with the primary and secondary time sources.

Verify the Network Time Protocol (NTP) configuration.
[edit system ntp]
authentication-key 1 type sha256 value "PSK"; ## SECRET-DATA
authentication-key 2 type sha1 value "PSK"; ## SECRET-DATA
server <address 1> key 1 prefer; ## SECRET-DATA
server <address 2> key 2; ## SECRET-DATA
trusted-key [ 1 2 ];
source-address <lo0 or OOBM address>;

If the network device is not configured to synchronize internal information system clocks with the primary and secondary time sources, this is a finding.

Vulnerability Number

V-253920

Documentable

False

Rule Version

JUEX-NM-000430

Severity Override Guidance

Determine if the network device is configured to synchronize internal information system clocks with the primary and secondary time sources.

Verify the Network Time Protocol (NTP) configuration.
[edit system ntp]
authentication-key 1 type sha256 value "PSK"; ## SECRET-DATA
authentication-key 2 type sha1 value "PSK"; ## SECRET-DATA
server <address 1> key 1 prefer; ## SECRET-DATA
server <address 2> key 2; ## SECRET-DATA
trusted-key [ 1 2 ];
source-address <lo0 or OOBM address>;

If the network device is not configured to synchronize internal information system clocks with the primary and secondary time sources, this is a finding.

Check Content Reference

M

Target Key

5477