STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-253951r1082966_rule

Vulnerability Number

V-253951

Group Title

SRG-NET-000193-L2S-000020

Rule Version

JUEX-L2-000040

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure class-of-service (CoS):
user@host> configure
user@host# set class-of-service classifiers dscp <classifier name> import default
user@host# set class-of-service classifiers dscp <classifier name> forwarding-class <req’d forwarding class name> loss-priority <low|high> code-points <DSCP code point>
user@host# set class-of-service classifiers dscp <classifier name> forwarding-class <req’d forwarding class name> loss-priority <low|high> code-points <DSCP code point> (optional - only if multiple DSCP values are used)
user@host# set class-of-service interfaces <interface name> scheduler-map <scheduler map name>
user@host# set class-of-service interfaces <interface name> unit <unit number> classifiers dscp <classifier name>
user@host# set class-of-service interfaces <uplink interface> scheduler-map <scheduler map name>
user@host# set class-of-service interfaces <uplink interface> unit <unit number> classifiers dscp <classifier name>
user@host# set class-of-service scheduler-maps <scheduler map name> forwarding-class best-effort scheduler <scheduler name> (e.g., be-scheduler)
user@host# set class-of-service scheduler-maps <scheduler map name> forwarding-class <req’d forwarding class> scheduler <scheduler name> (e.g., ef-scheduler)
user@host# set class-of-service scheduler-maps <scheduler map name> forwarding-class network-control scheduler <scheduler name> (e.g. nc-scheduler)
user@host# set class-of-service schedulers <be-scheduler name> transmit-rate (exact <value> | percent (0..100) | remainder)
user@host# set class-of-service schedulers <be-scheduler name> priority (high | low | medium-high | medium-low | strict-high)
set class-of-service schedulers <ef-scheduler name> shaping-rate percent (0..100)
user@host# set class-of-service schedulers <ef-scheduler name> priority (high | low | medium-high | medium-low | strict-high)
user@host# set class-of-service schedulers <nc-scheduler name> shaping-rate percent (0..100)
user@host# set class-of-service schedulers <nc-scheduler name> priority (high | low | medium-high | medium-low | strict-high)

Note: The classifier method (ToS bit, DSCP marking, etc.) and values, interfaces, priorities, and rates must be appropriate for the target environment.

Check Contents

Review the switch configuration to verify that Class-of-Service (CoS) has been enabled. Ensure sufficient capacity is available for mission-critical traffic to enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

By default, Junos implements a standard CoS (QoS) strategy. Although some devices implement different queues or queue numbers, generally there is at least a four-queue model with two active queues: 95 percent Best Effort (BE) and 5 percent Network Control (NC). Verify additional queues are configured to support the traffic priorities of the Combatant Commanders/Services/Agencies.

The example CoS below adds a queue for one type of prioritized traffic. The example shows the interdependency of the classifiers, the schedulers, and the interfaces but the names, classifier code points, and scheduler rates are only examples. The names, code points, and rates must be appropriate for the target environment. Additional configuration is required for each type of prioritized traffic.

Note: The example CoS names, scheduler rates, and DSCP values must not be considered requirements. The names, rates, and values must be appropriately configured for the target environment.

user@host> show configuration class-of-service
classifiers {
dscp prioritized-traffic-classifier {
import default;
forwarding-class expedited-forwarding {
loss-priority low code-points [ 101110 100100 ];
}
}
}
interfaces {
<interface> {
scheduler-map prioritized-traffic-map;
unit <logical unit> {
classifiers {
dscp prioritized-traffic-classifier;
}
}
}
<uplink interface> {
scheduler-map prioritized-traffic-map;
unit <logical unit> {
classifiers {
dscp prioritized-traffic-classifier;
}
}
}
scheduler-maps {
prioritized-traffic-map {
forwarding-class best-effort scheduler be-scheduler;
forwarding-class expedited-forwarding scheduler ef-scheduler;
forwarding-class network-control scheduler nc-scheduler;
}
}
schedulers {
be-scheduler {
transmit-rate {
remainder;
}
priority low;
}
ef-scheduler {
shaping-rate percent 20;
priority strict-high;
}
nc-scheduler {
shaping-rate percent 5;
priority strict-high;
}
}

If the switch is not configured to implement a QoS policy, this is a finding.

Vulnerability Number

V-253951

Documentable

False

Rule Version

JUEX-L2-000040

Severity Override Guidance

Review the switch configuration to verify that Class-of-Service (CoS) has been enabled. Ensure sufficient capacity is available for mission-critical traffic to enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

By default, Junos implements a standard CoS (QoS) strategy. Although some devices implement different queues or queue numbers, generally there is at least a four-queue model with two active queues: 95 percent Best Effort (BE) and 5 percent Network Control (NC). Verify additional queues are configured to support the traffic priorities of the Combatant Commanders/Services/Agencies.

The example CoS below adds a queue for one type of prioritized traffic. The example shows the interdependency of the classifiers, the schedulers, and the interfaces but the names, classifier code points, and scheduler rates are only examples. The names, code points, and rates must be appropriate for the target environment. Additional configuration is required for each type of prioritized traffic.

Note: The example CoS names, scheduler rates, and DSCP values must not be considered requirements. The names, rates, and values must be appropriately configured for the target environment.

user@host> show configuration class-of-service
classifiers {
dscp prioritized-traffic-classifier {
import default;
forwarding-class expedited-forwarding {
loss-priority low code-points [ 101110 100100 ];
}
}
}
interfaces {
<interface> {
scheduler-map prioritized-traffic-map;
unit <logical unit> {
classifiers {
dscp prioritized-traffic-classifier;
}
}
}
<uplink interface> {
scheduler-map prioritized-traffic-map;
unit <logical unit> {
classifiers {
dscp prioritized-traffic-classifier;
}
}
}
scheduler-maps {
prioritized-traffic-map {
forwarding-class best-effort scheduler be-scheduler;
forwarding-class expedited-forwarding scheduler ef-scheduler;
forwarding-class network-control scheduler nc-scheduler;
}
}
schedulers {
be-scheduler {
transmit-rate {
remainder;
}
priority low;
}
ef-scheduler {
shaping-rate percent 20;
priority strict-high;
}
nc-scheduler {
shaping-rate percent 5;
priority strict-high;
}
}

If the switch is not configured to implement a QoS policy, this is a finding.

Check Content Reference

M

Target Key

5478