STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must not use the default VLAN for management traffic.

DISA Rule

SV-253969r997519_rule

Vulnerability Number

V-253969

Group Title

SRG-NET-000512-L2S-000010

Rule Version

JUEX-L2-000220

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the switch for management access to use a VLAN other than the default VLAN.

set interfaces <interface name> unit 0 family ethernet-switching interface-mode access
set interfaces <interface name> unit 0 family ethernet-switching vlan members <vlan name>

Check Contents

Review the switch configuration and verify that the default VLAN is not used to access the switch for management.

Verify access interfaces used for management are assigned to an appropriate VLAN as in the example below.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members <vlan name>;
}
}
}
}

If the default VLAN is being used to access the switch, this is a finding.

Vulnerability Number

V-253969

Documentable

False

Rule Version

JUEX-L2-000220

Severity Override Guidance

Review the switch configuration and verify that the default VLAN is not used to access the switch for management.

Verify access interfaces used for management are assigned to an appropriate VLAN as in the example below.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members <vlan name>;
}
}
}
}

If the default VLAN is being used to access the switch, this is a finding.

Check Content Reference

M

Target Key

5478