STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

If STP is used, the Juniper EX switch must be configured to implement Rapid STP, or Multiple STP, where VLANs span multiple switches with redundant links.

DISA Rule

SV-253964r843925_rule

Vulnerability Number

V-253964

Group Title

SRG-NET-000512-L2S-000003

Rule Version

JUEX-L2-000170

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure Rapid STP to be implemented at the access and distribution layers where VLANs span multiple switches.

RSTP:
set protocols rstp bridge-priority (0..61440 in 4k increments) << e.g. 0, 4k, 8k...60k
set protocols rstp interface <interface name> edge
set protocols rstp interface <interface name-1> mode point-to-point
set protocols rstp bpdu-block-on-edge

MSTP:
set protocols mstp configuration-name <name>
set protocols mstp revision-level (0..65535)
set protocols mstp max-age (6..40 seconds)
set protocols mstp hello-time (1..10 seconds)
set protocols mstp forward-delay (4..30 seconds)
set protocols mstp bridge-priority (0..61440 in 4k increments) << e.g. 0, 4k, 8k...60k
set protocols mstp bpdu-block-on-edge
set protocols mstp interface <interface name> edge
set protocols mstp interface <interface name-1> mode point-to-point
set protocols mstp msti 3 bridge-priority (0..61440 in 4k increments) << e.g. 0, 4k, 8k...60k
set protocols mstp msti 3 vlan <VLAN ID 1>
set protocols mstp msti 3 vlan <VLAN ID 2>

Check Contents

If STP is required, then review the switch configuration to verify that Rapid STP or Multiple STP has been implemented. RSTP and MSTP are similar, except MSTP is more granular, flexible, and scalable. RTSP and MSTP can be enabled simultaneously, but in general only one STP is configured.

RSTP:
[edit protocols rstp]
rstp {
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
interface <interface name> {
edge;
}
interface <interface name-1> {
mode point-to-point;
}
bpdu-block-on-edge;
}

-OR-

MSTP:
[edit protocols mstp]
configuration-name <name>;
revision-level (0..65535);
max-age (6..40 seconds);
hello-time (1..10 seconds);
forward-delay (4..30 seconds);
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
bpdu-block-on-edge;
interface <interface name> {
edge;
}
interface <interface name-1> {
mode point-to-point;
}
msti 3 {
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
vlan [ vlan-id-1 vlan-id-2 ];
}

If Rapid STP or Multiple STP has not been implemented where an STP is required, this is a finding.

Vulnerability Number

V-253964

Documentable

False

Rule Version

JUEX-L2-000170

Severity Override Guidance

If STP is required, then review the switch configuration to verify that Rapid STP or Multiple STP has been implemented. RSTP and MSTP are similar, except MSTP is more granular, flexible, and scalable. RTSP and MSTP can be enabled simultaneously, but in general only one STP is configured.

RSTP:
[edit protocols rstp]
rstp {
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
interface <interface name> {
edge;
}
interface <interface name-1> {
mode point-to-point;
}
bpdu-block-on-edge;
}

-OR-

MSTP:
[edit protocols mstp]
configuration-name <name>;
revision-level (0..65535);
max-age (6..40 seconds);
hello-time (1..10 seconds);
forward-delay (4..30 seconds);
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
bpdu-block-on-edge;
interface <interface name> {
edge;
}
interface <interface name-1> {
mode point-to-point;
}
msti 3 {
bridge-priority (0..61440 in 4k increments); << e.g. 0, 4k, 8k...60k
vlan [ vlan-id-1 vlan-id-2 ];
}

If Rapid STP or Multiple STP has not been implemented where an STP is required, this is a finding.

Check Content Reference

M

Target Key

5478