STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to enable STP Loop Protection on all non-designated STP switch ports.

DISA Rule

SV-253957r843904_rule

Vulnerability Number

V-253957

Group Title

SRG-NET-000362-L2S-000023

Rule Version

JUEX-L2-000100

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch to have STP Loop Protection enabled on all non-designated STP interfaces.

RSTP or VSTP non-designated interface loop protection:
set protocols rstp interface <interface name> bpdu-timeout-action block
set protocols vstp interface <interface name> bpdu-timeout-action block

All instances on an MSTP interface:
set protocols mstp interface <interface name> bpdu-timeout-action block

Note: Loop Protection and Root Protection are mutually exclusive and cannot be simultaneously configured on the same interface.

Check Contents

Review the switch configuration to verify that STP Loop Protection is enabled on all non-designated STP switch ports.

Verify STP Loop Protection for RSTP and VSTP.
[edit protocols]
rstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}
vstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}

Verify Loop Protection for all instances on an MSTP interface:
[protocols]
mstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}

Note: Loop Protection and Root Protection are mutually exclusive and cannot be simultaneously configured on the same interface.

If STP Loop Protection is not configured on non-designated STP ports, this is a finding.

Vulnerability Number

V-253957

Documentable

False

Rule Version

JUEX-L2-000100

Severity Override Guidance

Review the switch configuration to verify that STP Loop Protection is enabled on all non-designated STP switch ports.

Verify STP Loop Protection for RSTP and VSTP.
[edit protocols]
rstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}
vstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}

Verify Loop Protection for all instances on an MSTP interface:
[protocols]
mstp {
interface <interface name> {
bpdu-timeout-action {
block;
}
}
}

Note: Loop Protection and Root Protection are mutually exclusive and cannot be simultaneously configured on the same interface.

If STP Loop Protection is not configured on non-designated STP ports, this is a finding.

Check Content Reference

M

Target Key

5478