STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to disable non-essential capabilities.

DISA Rule

SV-253948r843877_rule

Vulnerability Number

V-253948

Group Title

SRG-NET-000131-L2S-000014

Rule Version

JUEX-L2-000010

Severity

CAT I

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable the following services:

If present, delete the following directives:
delete system services finger
delete system services ftp
delete system services rlogin
delete system services telnet
delete system services xnm-clear-text
delete system services tftp
delete system services rest http
delete system services web-management

Disable the web-management process:
set system processes web-management disable

Check Contents

Review the switch configuration and verify the switch does not have an unnecessary or non-secure services enabled. For example, the following directives should not be in the configuration (deleted) or, if present, must be disabled (inactive):

Verify the following commands are not present:
[edit system services]
finger;
ftp;
rlogin;
telnet;
xnm-clear-text;
tftp;
rest {
http;
}
web-management {
http;
https;
}
Note: If the services listed above are marked "inactive", they are not enabled. For example, although the FTP stanza is present in the following snippet, it is disabled (inactive):
[edit system services]
inactive: ftp;

Because J-Web was not included in the FIPS certification, verify the web-management process is disabled.
[edit system services]
web-management disable;

If any unnecessary services are enabled, this is a finding.

Vulnerability Number

V-253948

Documentable

False

Rule Version

JUEX-L2-000010

Severity Override Guidance

Review the switch configuration and verify the switch does not have an unnecessary or non-secure services enabled. For example, the following directives should not be in the configuration (deleted) or, if present, must be disabled (inactive):

Verify the following commands are not present:
[edit system services]
finger;
ftp;
rlogin;
telnet;
xnm-clear-text;
tftp;
rest {
http;
}
web-management {
http;
https;
}
Note: If the services listed above are marked "inactive", they are not enabled. For example, although the FTP stanza is present in the following snippet, it is disabled (inactive):
[edit system services]
inactive: ftp;

Because J-Web was not included in the FIPS certification, verify the web-management process is disabled.
[edit system services]
web-management disable;

If any unnecessary services are enabled, this is a finding.

Check Content Reference

M

Target Key

5478