STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.

DISA Rule

SV-254003r844042_rule

Vulnerability Number

V-254003

Group Title

SRG-NET-000192-RTR-000002

Rule Version

JUEX-RT-000310

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure a MAC address learning limit for each VPLS bridge domain.

set routing-instance <name> protocols vpls interface-mac-limit <value>
set routing-instance <name> protocols vpls interface <name>.<logical unit> interface-mac-limit <value>

Check Contents

Review the PE router configuration to determine if a MAC address limit has been set for each bridge domain.

Verify the MAC address limit is globally defined for the VPLS protocol or at each interface assigned to the routing instance.

[edit routing-instance]
<instance name> {
protocols {
vpls {
interface-mac-limit {
<value>;
}
interface <interface name>.<logical unit> {
interface-mac-limit {
<value>;
}
}
}
}
}

Note: Only EX9200-series devices currently support VPLS.

If a limit has not been configured, this is a finding.

Vulnerability Number

V-254003

Documentable

False

Rule Version

JUEX-RT-000310

Severity Override Guidance

Review the PE router configuration to determine if a MAC address limit has been set for each bridge domain.

Verify the MAC address limit is globally defined for the VPLS protocol or at each interface assigned to the routing instance.

[edit routing-instance]
<instance name> {
protocols {
vpls {
interface-mac-limit {
<value>;
}
interface <interface name>.<logical unit> {
interface-mac-limit {
<value>;
}
}
}
}
}

Note: Only EX9200-series devices currently support VPLS.

If a limit has not been configured, this is a finding.

Check Content Reference

M

Target Key

5479