STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to have all inactive interfaces disabled.

DISA Rule

SV-253988r843997_rule

Vulnerability Number

V-253988

Group Title

SRG-NET-000019-RTR-000007

Rule Version

JUEX-RT-000160

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Disable inactive interfaces.

delete interfaces <interface name>
-or-
set interfaces <interface name> disable
-or-
set interfaces interface-range DISABLED_INTERFACES member <interface name>
set interfaces interface-range DISABLED_INTERFACES member-range <first interface name> to <last interface name>
set interfaces interface-range DISABLED_INTERFACES disable

Check Contents

Review the router configuration and verify unused interfaces are not configured (implicitly disabled) or are explicitly disabled. If explicitly disabling interfaces, verify multiple interfaces are disabled with the "interface-range" command or separately at each interface declaration.

[edit interfaces]
interface-range DISABLED_INTERFACES {
member <interface name>;
member-range <first interface> to <last interface>;
disable;
}
<interface name> {
disable;
}

Note: Individually disabled interfaces should not be included in any "interface-range" stanza. The "member-range" directive assigns the configured parameter(s) to contiguously numbered interfaces.

Junos lists interfaces in order so a "missing" interface is not enabled. For instance, if ge-0/0/0 and ge-0/0/2 are configured, but there is no individual ge-0/0/1 stanza and that interface is not a member of an interface-range, then ge-0/0/1 is implicitly disabled.

If an interface is not being used but is configured or enabled, this is a finding.

Vulnerability Number

V-253988

Documentable

False

Rule Version

JUEX-RT-000160

Severity Override Guidance

Review the router configuration and verify unused interfaces are not configured (implicitly disabled) or are explicitly disabled. If explicitly disabling interfaces, verify multiple interfaces are disabled with the "interface-range" command or separately at each interface declaration.

[edit interfaces]
interface-range DISABLED_INTERFACES {
member <interface name>;
member-range <first interface> to <last interface>;
disable;
}
<interface name> {
disable;
}

Note: Individually disabled interfaces should not be included in any "interface-range" stanza. The "member-range" directive assigns the configured parameter(s) to contiguously numbered interfaces.

Junos lists interfaces in order so a "missing" interface is not enabled. For instance, if ge-0/0/0 and ge-0/0/2 are configured, but there is no individual ge-0/0/1 stanza and that interface is not a member of an interface-range, then ge-0/0/1 is implicitly disabled.

If an interface is not being used but is configured or enabled, this is a finding.

Check Content Reference

M

Target Key

5479