STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to prune the default VLAN from all trunked interfaces that do not require it.

DISA Rule

SV-253968r843937_rule

Vulnerability Number

V-253968

Group Title

SRG-NET-000512-L2S-000009

Rule Version

JUEX-L2-000210

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Remove unnecessary VLANs from trunked interfaces.

delete interfaces <trunked interface name> unit 0 family ethernet-switching vlan members <default | other unnecessary VLAN name>

Check Contents

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}

If the default VLAN is not pruned from trunk links that should not be transporting frames for that VLAN, this is a finding.

Vulnerability Number

V-253968

Documentable

False

Rule Version

JUEX-L2-000210

Severity Override Guidance

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}

If the default VLAN is not pruned from trunk links that should not be transporting frames for that VLAN, this is a finding.

Check Content Reference

M

Target Key

5478