STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must not have a native VLAN ID assigned, or have a unique native VLAN ID, for all 802.1q trunk links.

DISA Rule

SV-253971r843946_rule

Vulnerability Number

V-253971

Group Title

SRG-NET-000512-L2S-000012

Rule Version

JUEX-L2-000240

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

To ensure the integrity of the trunk link, either remove the native VLAN ID or configure the native VLAN ID with a unique value. If used, the native VLAN ID must be the same on both ends of the trunk link.

Example deleting a native VLAN ID:
delete interfaces <interface name> native-vlan-id

Example configuring a native VLAN ID:
set interfaces <interface name> native-vlan-id <VLAN ID not 1>

Example configuring a VLAN used as native for any trunked interface:
set vlans vlan_name vlan-id 30

Check Contents

Review the switch configuration and examine all trunked interfaces to verify no native VLAN ID is assigned. If a native VLAN has been assigned, verify the VLAN is unique.

By default, there are no native VLANs assigned to any trunked interface.

Verify trunked interface do not have a native VLAN ID configured.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}

If trunked interfaces require a native VLAN, verify it is unique.
[edit interfaces]
<interface name> {
native-vlan-id <unique VLAN ID>;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}
Note: By default, Juniper switches do not automatically assign a native VLAN. Configuring an interface with "interface-mode trunk" does not automatically assign the default VLAN.

Verify any VLAN assigned as native for any trunked interface has been configured.
[edit vlans]
native_vlan_name {
vlan-id <VLAN ID>;
}

If trunked interfaces do not have a native VLAN ID configured, this is not a finding.

If a native VLAN is configured and does not have a unique VLAN ID, this is a finding.

Vulnerability Number

V-253971

Documentable

False

Rule Version

JUEX-L2-000240

Severity Override Guidance

Review the switch configuration and examine all trunked interfaces to verify no native VLAN ID is assigned. If a native VLAN has been assigned, verify the VLAN is unique.

By default, there are no native VLANs assigned to any trunked interface.

Verify trunked interface do not have a native VLAN ID configured.
[edit interfaces]
<interface name> {
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}

If trunked interfaces require a native VLAN, verify it is unique.
[edit interfaces]
<interface name> {
native-vlan-id <unique VLAN ID>;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ vlan_name ... vlan_name ];
}
}
}
}
Note: By default, Juniper switches do not automatically assign a native VLAN. Configuring an interface with "interface-mode trunk" does not automatically assign the default VLAN.

Verify any VLAN assigned as native for any trunked interface has been configured.
[edit vlans]
native_vlan_name {
vlan-id <VLAN ID>;
}

If trunked interfaces do not have a native VLAN ID configured, this is not a finding.

If a native VLAN is configured and does not have a unique VLAN ID, this is a finding.

Check Content Reference

M

Target Key

5478