STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.

DISA Rule

SV-253967r997518_rule

Vulnerability Number

V-253967

Group Title

SRG-NET-000512-L2S-000008

Rule Version

JUEX-L2-000200

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Assign all access interfaces to a VLAN not used for L2 control traffic.

Interface range configuration:
set interfaces interface-range name member <interface name>
set interfaces interface-range name member-range <starting interface name> to <ending interface name>
set interfaces interface-range name unit 0 family ethernet-switching vlan members <vlan name>

Individual interface configuration:
set interfaces <interface name> unit 0 family ethernet-switching vlan members <vlan name>

Configure the VLAN:
set vlans <vlan name> vlan-id <VLAN ID>

Check Contents

Review the switch configurations and verify all access interfaces are assigned to a configured VLAN not used for L2 control traffic.

If assigning via interface-range, the configuration will be similar to the example.
[edit interfaces]
interface-range <name> {
member <interface name>;
member-range <starting interface name> to <ending interface name>; <<< Member ranges are contiguous from <start interface> to <end interface> inclusive
unit 0 {
family ethernet-switching {
vlan {
members <vlan name>;
}
}
}
}

If assigning individually, the configuration will be similar to the example.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
vlan {
members <vlan name>;
}
}
}
}

Verify the assigned VLANs are configured.
[edit vlans]
<vlan name> {
vlan-id <VLAN ID>;
}
Note: Assigning interfaces to a VLAN automatically removes them from the default VLAN.

If there are access interfaces assigned to the VLANs used for L2 control traffic, this is a finding.

Vulnerability Number

V-253967

Documentable

False

Rule Version

JUEX-L2-000200

Severity Override Guidance

Review the switch configurations and verify all access interfaces are assigned to a configured VLAN not used for L2 control traffic.

If assigning via interface-range, the configuration will be similar to the example.
[edit interfaces]
interface-range <name> {
member <interface name>;
member-range <starting interface name> to <ending interface name>; <<< Member ranges are contiguous from <start interface> to <end interface> inclusive
unit 0 {
family ethernet-switching {
vlan {
members <vlan name>;
}
}
}
}

If assigning individually, the configuration will be similar to the example.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
vlan {
members <vlan name>;
}
}
}
}

Verify the assigned VLANs are configured.
[edit vlans]
<vlan name> {
vlan-id <VLAN ID>;
}
Note: Assigning interfaces to a VLAN automatically removes them from the default VLAN.

If there are access interfaces assigned to the VLANs used for L2 control traffic, this is a finding.

Check Content Reference

M

Target Key

5478