STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to enable IGMP or MLD Snooping on all VLANs.

DISA Rule

SV-253963r843922_rule

Vulnerability Number

V-253963

Group Title

SRG-NET-000512-L2S-000002

Rule Version

JUEX-L2-000160

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.

Global:
set protocols igmp-snooping vlan all immediate-leave
set protocols igmp-snooping vlan all interface <multicast router interface name>.<logical unit> multicast-router-interface
set protocols mld-snooping vlan all immediate-leave
set protocols mld-snooping vlan all interface <multicast router interface name>.<logical unit> multicast-router-interface

Per VLAN:
set protocols igmp-snooping vlan vlan-name immediate-leave
set protocols igmp-snooping vlan vlan-name interface <multicast router interface name>.<logical unit> multicast-router-interface
set protocols igmp-snooping vlan vlan-name interface <host interface name>.<logical unit> host-only-interface
set protocols mld-snooping vlan vlan-name immediate-leave
set protocols mld-snooping vlan vlan-name interface <multicast router interface name>.<logical unit> multicast-router-interface
set protocols mld-snooping vlan vlan-name interface <host interface name>.<logical unit> host-only-interface

Check Contents

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.

Verify IGMP and MLD is globally configured for all VLANs:
[edit protocols]
igmp-snooping {
vlan all {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
}
}
mld-snooping {
vlan all {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
}
}

For VLAN-specific values, verify IGMP and MLD snooping is configured for each VLAN:
[edit protocols]
igmp-snooping {
vlan vlan-name {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
interface <host interface name>.<logical unit> {
host-only-interface;
}
}
}
mld-snooping {
vlan vlan-name {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
interface <host interface name>.<logical unit> {
host-only-interface;
}
}
}

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-253963

Documentable

False

Rule Version

JUEX-L2-000160

Severity Override Guidance

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.

Verify IGMP and MLD is globally configured for all VLANs:
[edit protocols]
igmp-snooping {
vlan all {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
}
}
mld-snooping {
vlan all {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
}
}

For VLAN-specific values, verify IGMP and MLD snooping is configured for each VLAN:
[edit protocols]
igmp-snooping {
vlan vlan-name {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
interface <host interface name>.<logical unit> {
host-only-interface;
}
}
}
mld-snooping {
vlan vlan-name {
immediate-leave;
interface <multicast router interface name>.<logical unit> {
multicast-router-interface;
}
interface <host interface name>.<logical unit> {
host-only-interface;
}
}
}

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

5478