STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to enable IP Source Guard on all user-facing or untrusted access VLANs with active access interfaces.

DISA Rule

SV-253960r1212014_rule

Vulnerability Number

V-253960

Group Title

SRG-NET-000362-L2S-000026

Rule Version

JUEX-L2-000130

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch to have IP Source Guard enabled on all user-facing or untrusted VLANs with active access interfaces.

1. Enter configuration mode.
2. Configure user-facing or untrusted VLANs with active access interfaces with IP source guard.
3. Commit the configuration.

user@host> configure
Entering configuration mode

user@host# set vlans <untrusted VLAN name> vlan-id <untrusted VLAN ID>

user@host# set vlans <untrusted VLAN name> forwarding-options dhcp-security ip-source-guard

user@host# commit
commit complete

Check Contents

Review the switch configuration to verify that IP Source Guard is enabled on all user-facing or untrusted VLANs with active access interfaces. Configuring IP Source Guard automatically enables DHCP snooping.

Devices such as printers, servers, and VoIP phones are under enterprise control and connected to controlled access interfaces (802.1x, Static MAC Bypass, or MAC RADIUS), making them trusted sources in nonuser-facing VLANs.

Verify IP Source Guard on user-facing or untrusted VLANs with active access interfaces.

user@host> show configuration vlans
<untrusted VLAN name> {
vlan-id <VLAN ID>;
forwarding-options {
dhcp-security {
ip-source-guard;
}
}
}
Note: IP Source Guard depends on DHCP snooping or static MAC address bindings.

This check is not applicable to switches configured with user-facing or untrusted VLANs merely for inclusion in trunks (e.g., core or distribution switch without access interfaces assigned to user-facing or untrusted VLANs).

If the switch does not have IP Source Guard enabled on all user-facing or untrusted VLANs with active access interfaces, this is a finding.

Vulnerability Number

V-253960

Documentable

False

Rule Version

JUEX-L2-000130

Severity Override Guidance

Review the switch configuration to verify that IP Source Guard is enabled on all user-facing or untrusted VLANs with active access interfaces. Configuring IP Source Guard automatically enables DHCP snooping.

Devices such as printers, servers, and VoIP phones are under enterprise control and connected to controlled access interfaces (802.1x, Static MAC Bypass, or MAC RADIUS), making them trusted sources in nonuser-facing VLANs.

Verify IP Source Guard on user-facing or untrusted VLANs with active access interfaces.

user@host> show configuration vlans
<untrusted VLAN name> {
vlan-id <VLAN ID>;
forwarding-options {
dhcp-security {
ip-source-guard;
}
}
}
Note: IP Source Guard depends on DHCP snooping or static MAC address bindings.

This check is not applicable to switches configured with user-facing or untrusted VLANs merely for inclusion in trunks (e.g., core or distribution switch without access interfaces assigned to user-facing or untrusted VLANs).

If the switch does not have IP Source Guard enabled on all user-facing or untrusted VLANs with active access interfaces, this is a finding.

Check Content Reference

M

Target Key

5478