STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must use an an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server.

DISA Rule

SV-253926r961506_rule

Vulnerability Number

V-253926

Group Title

SRG-APP-000395-NDM-000347

Rule Version

JUEX-NM-000490

Severity

CAT III

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure the network device to authenticate Network Time Protocol sources using FIPS-validated algorithms.

set system ntp authentication-key 1 type sha256
set system ntp authentication-key 1 value "PSK"
set system ntp authentication-key 2 type sha1
set system ntp authentication-key 2 value "PSK"
set system ntp server <address 1> key 1
set system ntp server <address 1> prefer
set system ntp server <address 2> key 2
set system ntp trusted-key 1
set system ntp trusted-key 2

If the network device does not support FIPS-validated algorithms, configure NTP authentication using cryptographically based algorithms.
set system ntp authentication-key 3 type md5
set system ntp authentication-key 3 value "PSK"
set system ntp server <address 3> key 3
set system ntp trusted-key 3

Check Contents

Review the Juniper EX configuration to determine if it obtains time information from a trusted source.

[edit system ntp]
authentication-key 1 type sha256 value "PSK"; ## SECRET-DATA
authentication-key 2 type sha1 value "PSK"; ## SECRET-DATA
server <address 1> key 1 prefer; ## SECRET-DATA
server <address 2> key 2; ## SECRET-DATA
trusted-key [ 1 2 ];

If the network device does not support FIPS-validated algorithms, verify the network device configuration to determine NTP endpoints are authenticated before establishing the local, remote, or network connection using cryptographically based algorithms.
[edit system ntp]
authentication-key 3 type md5 value "PSK"; ## SECRET-DATA
server <address 3> key 3; ## SECRET-DATA
trusted-key [ 1 2 3 ];

If the Juniper EX switch is not configured to use an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server, this is a finding.

Vulnerability Number

V-253926

Documentable

False

Rule Version

JUEX-NM-000490

Severity Override Guidance

Review the Juniper EX configuration to determine if it obtains time information from a trusted source.

[edit system ntp]
authentication-key 1 type sha256 value "PSK"; ## SECRET-DATA
authentication-key 2 type sha1 value "PSK"; ## SECRET-DATA
server <address 1> key 1 prefer; ## SECRET-DATA
server <address 2> key 2; ## SECRET-DATA
trusted-key [ 1 2 ];

If the network device does not support FIPS-validated algorithms, verify the network device configuration to determine NTP endpoints are authenticated before establishing the local, remote, or network connection using cryptographically based algorithms.
[edit system ntp]
authentication-key 3 type md5 value "PSK"; ## SECRET-DATA
server <address 3> key 3; ## SECRET-DATA
trusted-key [ 1 2 3 ];

If the Juniper EX switch is not configured to use an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server, this is a finding.

Check Content Reference

M

Target Key

5477