STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to enable BPDU Protection on all user-facing or untrusted access switch ports.

DISA Rule

SV-253956r843901_rule

Vulnerability Number

V-253956

Group Title

SRG-NET-000362-L2S-000022

Rule Version

JUEX-L2-000090

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch to have BPDU Protection enabled on all user-facing or untrusted access switch interfaces.

set protocols mstp bpdu-block-on-edge
set protocols mstp interface <interface name> edge

Note: Configuring BPDU Protection and Root Protection on the same interface is supported, but redundant because BPDU protection includes Root Protection.

Check Contents

Review the switch configuration to verify that BPDU Protection is enabled on all user-facing or untrusted access switch interfaces.

BPDU Protection discards all BPDUs received on a configured interface and stops forwarding on that interface. In contrast, Root Protection discards only superior root BPDUs but accepts remaining BPDU types. Verify BDPU Protection (bpdu-block-on-edge) and the edge interfaces where no BPDUs are expected.

[protocols]
mstp {
bpdu-block-on-edge;
interface <interface name> {
edge;
}
}
Note: Configuring BPDU Protection and Root Protection on the same interface is supported, but redundant because BPDU protection includes Root Protection.

If the switch has not enabled BPDU Protection, this is a finding.

Vulnerability Number

V-253956

Documentable

False

Rule Version

JUEX-L2-000090

Severity Override Guidance

Review the switch configuration to verify that BPDU Protection is enabled on all user-facing or untrusted access switch interfaces.

BPDU Protection discards all BPDUs received on a configured interface and stops forwarding on that interface. In contrast, Root Protection discards only superior root BPDUs but accepts remaining BPDU types. Verify BDPU Protection (bpdu-block-on-edge) and the edge interfaces where no BPDUs are expected.

[protocols]
mstp {
bpdu-block-on-edge;
interface <interface name> {
edge;
}
}
Note: Configuring BPDU Protection and Root Protection on the same interface is supported, but redundant because BPDU protection includes Root Protection.

If the switch has not enabled BPDU Protection, this is a finding.

Check Content Reference

M

Target Key

5478