STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to set all enabled user-facing or untrusted ports as access interfaces.

DISA Rule

SV-253970r1082976_rule

Vulnerability Number

V-253970

Group Title

SRG-NET-000512-L2S-000011

Rule Version

JUEX-L2-000230

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Disable trunking on all enabled user-facing or untrusted access interfaces.

Delete "interface-mode" from an enabled user-facing or untrusted interface to inherit the default access mode.
user@host> configure
user@host# delete interfaces <interface name> unit 0 family ethernet-switching interface-mode

Alternatively, explicitly set the enabled user-facing or untrusted interface mode to access.
user@host> configure
user@host# set interfaces <interface name> unit 0 family ethernet-switching interface-mode access

Check Contents

Review the switch configuration and examine all enabled user-facing or untrusted interfaces configured with family ethernet-switching.

1. Interfaces implicitly configured with "interface-mode" access and family ethernet-switching. Note: The default interface-mode is "access".
user@host> show configuration interfaces
<interface name> {
unit 0 {
family ethernet-switching {
}
}
}


2. Interfaces explicitly configured with "interface-mode" access and family ethernet-switching.
user@host> show configuration interfaces
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
}
}
}

If any of the enabled user-facing access interfaces are configured as a trunk, this is a finding.

Vulnerability Number

V-253970

Documentable

False

Rule Version

JUEX-L2-000230

Severity Override Guidance

Review the switch configuration and examine all enabled user-facing or untrusted interfaces configured with family ethernet-switching.

1. Interfaces implicitly configured with "interface-mode" access and family ethernet-switching. Note: The default interface-mode is "access".
user@host> show configuration interfaces
<interface name> {
unit 0 {
family ethernet-switching {
}
}
}


2. Interfaces explicitly configured with "interface-mode" access and family ethernet-switching.
user@host> show configuration interfaces
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
}
}
}

If any of the enabled user-facing access interfaces are configured as a trunk, this is a finding.

Check Content Reference

M

Target Key

5478