STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to enable DHCP snooping for all user VLANs with active access interfaces to validate DHCP messages from untrusted sources.

DISA Rule

SV-253959r1212011_rule

Vulnerability Number

V-253959

Group Title

SRG-NET-000362-L2S-000025

Rule Version

JUEX-L2-000120

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch with DHCP snooping for all user-facing or untrusted VLANs with active access interfaces to validate DHCP messages from untrusted sources.

1. Enter configuration mode.
2. Configure user-facing or untrusted VLANs with active access interfaces with DHCP snooping.
3. Commit the configuration.

user@host> configure
Entering configuration mode

user@host# set vlans <untrusted VLAN name> vlan-id <untrusted VLAN ID>

user@host# set vlans <untrusted VLAN name> forwarding-options dhcp-security

user@host# commit
commit complete

Check Contents

Review the switch configuration and verify that DHCP snooping is enabled on all user-facing or untrusted VLANs with active access interfaces.

DHCP snooping is enabled if dhcp-security is configured for any VLAN, and is automatically enabled whenever any other VLAN port security feature is configured (e.g., IP Source Guard or Dynamic ARP Inspection).

Devices such as printers, servers, and VoIP phones are under administrative control and connected to controlled access interfaces (802.1x, Static MAC Bypass, or MAC RADIUS), making them trusted sources in nonuser-facing VLANs. Trunked interfaces are trusted sources.

Verify DHCP snooping on user-facing or untrusted VLANs is configured with active access interfaces.

[edit vlans]
<untrusted VLAN name> {
vlan-id <VLAN ID>;
forwarding-options {
dhcp-security;
}
}

This check is not applicable to switches configured with user-facing or untrusted VLANs merely for inclusion in trunks (e.g., core or distribution switch without access interfaces assigned to user-facing or untrusted VLANs).

If the switch does not have DHCP snooping enabled for all user-facing or untrusted VLANs with active access interfaces to validate DHCP messages from untrusted sources, this is a finding.

Vulnerability Number

V-253959

Documentable

False

Rule Version

JUEX-L2-000120

Severity Override Guidance

Review the switch configuration and verify that DHCP snooping is enabled on all user-facing or untrusted VLANs with active access interfaces.

DHCP snooping is enabled if dhcp-security is configured for any VLAN, and is automatically enabled whenever any other VLAN port security feature is configured (e.g., IP Source Guard or Dynamic ARP Inspection).

Devices such as printers, servers, and VoIP phones are under administrative control and connected to controlled access interfaces (802.1x, Static MAC Bypass, or MAC RADIUS), making them trusted sources in nonuser-facing VLANs. Trunked interfaces are trusted sources.

Verify DHCP snooping on user-facing or untrusted VLANs is configured with active access interfaces.

[edit vlans]
<untrusted VLAN name> {
vlan-id <VLAN ID>;
forwarding-options {
dhcp-security;
}
}

This check is not applicable to switches configured with user-facing or untrusted VLANs merely for inclusion in trunks (e.g., core or distribution switch without access interfaces assigned to user-facing or untrusted VLANs).

If the switch does not have DHCP snooping enabled for all user-facing or untrusted VLANs with active access interfaces to validate DHCP messages from untrusted sources, this is a finding.

Check Content Reference

M

Target Key

5478