STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface.

DISA Rule

SV-253972r843949_rule

Vulnerability Number

V-253972

Group Title

SRG-NET-000512-L2S-000013

Rule Version

JUEX-L2-000250

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure all access interfaces with a VLAN separate from any VLAN configured as native on any trunked interface.

set interfaces <interface name> unit 0 family ethernet-switching interface-mode access
set interfaces <interface name> unit 0 family ethernet-switching vlan members vlan_name

set vlans <vlan_name> vlan-id <VLAN ID not assigned as native to any trunked interface>

Check Contents

Review the switch configurations and examine all access interfaces. Verify that they do not belong to any VLAN configured as native for any trunked interface.

Example trunked interface with native VLAN ID 30 and an access interface configured for vlan_name:
[edit interfaces]
<trunk interface name> {
native-vlan-id 30;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ <vlan name> ... <vlan name> ];
}
}
}
}
<access interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vlan_name;
}
}
}
}

Example VLANs (vlan-id 30 is configured on a trunked interface as native and must not be assigned to access interfaces):
[edit vlans]
vlan_30 {
vlan-id 30;
}
vlan_name {
vlan-id <VLAN ID not 30>;
}

If trunked interfaces are not configured with a native VLAN ID, this is not a finding.

If any trunked interface is configured with a native VLAN ID, and any access interfaces have been assigned to the same VLAN, this is a finding.

Vulnerability Number

V-253972

Documentable

False

Rule Version

JUEX-L2-000250

Severity Override Guidance

Review the switch configurations and examine all access interfaces. Verify that they do not belong to any VLAN configured as native for any trunked interface.

Example trunked interface with native VLAN ID 30 and an access interface configured for vlan_name:
[edit interfaces]
<trunk interface name> {
native-vlan-id 30;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ <vlan name> ... <vlan name> ];
}
}
}
}
<access interface name> {
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vlan_name;
}
}
}
}

Example VLANs (vlan-id 30 is configured on a trunked interface as native and must not be assigned to access interfaces):
[edit vlans]
vlan_30 {
vlan-id 30;
}
vlan_name {
vlan-id <VLAN ID not 30>;
}

If trunked interfaces are not configured with a native VLAN ID, this is not a finding.

If any trunked interface is configured with a native VLAN ID, and any access interfaces have been assigned to the same VLAN, this is a finding.

Check Content Reference

M

Target Key

5478