STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

DISA Rule

SV-253985r843988_rule

Vulnerability Number

V-253985

Group Title

SRG-NET-000019-RTR-000003

Rule Version

JUEX-RT-000130

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Document all enabled interfaces for PIM in the network's multicast topology diagram. Disable support for PIM on interfaces that are not required to support it.

For non-PIM routers, verify there is no [edit protocols pim] stanza. If the stanza is present, delete or deactivate it.
delete protocols pim
deactivate protocols pim

To disable PIM globally or for all interfaces.
set protocols pim disable
set protocols pim interface all disable

For PIM routers verify only the required interfaces are configured and all others are disabled:
set protocols pim interface <name>.<logical unit>
set protocols pim interface all disable

Check Contents

If IPv4 or IPv6 multicast routing is enabled, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram.

Review the router configuration to determine if multicast routing is enabled and which interfaces are enabled for PIM.

By default, PIM is not enabled on any interface. If not a PIM router, verify there is no PIM stanza at [edit protocols], PIM is disabled globally and/or for all interfaces, or that the stanza is inactive.
[edit protocols]
inactive: pim { << Stanza is removed or marked inactive
disable; << If stanza is present and not inactive, verify globally disabled
interface all { << If stanza is present, not inactive, and not globally disabled, disable for all interfaces
disable;
}
}

For PIM routers, verify only the required interfaces are configured. For example, the following configuration enables PIM on a specific interface and disables PIM for all others.
[edit protocols]
pim {
interface <name>.<logical unit>;
interface all {
disable;
}
}

Note: More specific interface configuration statements are preferred. In the example, the interface configuration is more specific than interface "all", so PIM is enabled only on that interface.

If an interface is not required to support multicast routing and it is enabled, this is a finding.

Vulnerability Number

V-253985

Documentable

False

Rule Version

JUEX-RT-000130

Severity Override Guidance

If IPv4 or IPv6 multicast routing is enabled, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram.

Review the router configuration to determine if multicast routing is enabled and which interfaces are enabled for PIM.

By default, PIM is not enabled on any interface. If not a PIM router, verify there is no PIM stanza at [edit protocols], PIM is disabled globally and/or for all interfaces, or that the stanza is inactive.
[edit protocols]
inactive: pim { << Stanza is removed or marked inactive
disable; << If stanza is present and not inactive, verify globally disabled
interface all { << If stanza is present, not inactive, and not globally disabled, disable for all interfaces
disable;
}
}

For PIM routers, verify only the required interfaces are configured. For example, the following configuration enables PIM on a specific interface and disables PIM for all others.
[edit protocols]
pim {
interface <name>.<logical unit>;
interface all {
disable;
}
}

Note: More specific interface configuration statements are preferred. In the example, the interface configuration is more specific than interface "all", so PIM is enabled only on that interface.

If an interface is not required to support multicast routing and it is enabled, this is a finding.

Check Content Reference

M

Target Key

5479