STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024: STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:SV-254004r844045_rule
V-254004
SRG-NET-000193-RTR-000001
JUEX-RT-000320
CAT III
10
Configure RSVP-TE enabled routers with refresh reduction features.
Junos earlier than 15.2:
set protocols rsvp interface <interface name>.<logical unit> aggregate
set protocols rsvp interface <interface name>.<logical unit> reliable
Junos 15.2 but pre 16.1R1:
set protocols rsvp interface <interface name>.<logical unit> reliable
Junos 16.1R1 and later:
set protocols rsvp interface <interface name>.<logical unit> <other configuration>
Review the router configuration to verify that the router has been configured to enable refresh reduction features. Junos OS controls RSVP refresh reduction features using two commands:
aggregate: RSVP message bundling and summary refresh.
reliable: RSVP message ID, reliable message delivery, and summary refresh.
Starting in Junos 15.2, refresh reduction is enabled by default and the "aggregate" command is deprecated. Configuring the "aggregate" command generates a warning message in the configuration file (## Warning: "aggregate" is deprecated). On Junos earlier than 15.2, verify the "aggregate" command is enabled. On Junos 15.2 and later, no command is required.
Junos earlier than 15.2:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
aggregate;
reliable; << If RSVP message ID and reliable message delivery are required.
}
}
Junos 15.2 but pre-16.1R1:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
reliable; << If RSVP message ID and reliable message delivery are required.
}
}
Starting in Junos 16.1R1, all refresh reduction features are enabled by default. Verify the 'no-reliable' command is configured only if RSVP message ID and reliable message delivery are not required. To enable all refresh reduction features, no commands are necessary.
Junos 16.1R1 and later:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
<other configuration>
}
}
If the router with RSVP-TE enabled does not have message pacing configured based on the link speed and input queue size of adjacent core routers, this is a finding.
V-254004
False
JUEX-RT-000320
Review the router configuration to verify that the router has been configured to enable refresh reduction features. Junos OS controls RSVP refresh reduction features using two commands:
aggregate: RSVP message bundling and summary refresh.
reliable: RSVP message ID, reliable message delivery, and summary refresh.
Starting in Junos 15.2, refresh reduction is enabled by default and the "aggregate" command is deprecated. Configuring the "aggregate" command generates a warning message in the configuration file (## Warning: "aggregate" is deprecated). On Junos earlier than 15.2, verify the "aggregate" command is enabled. On Junos 15.2 and later, no command is required.
Junos earlier than 15.2:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
aggregate;
reliable; << If RSVP message ID and reliable message delivery are required.
}
}
Junos 15.2 but pre-16.1R1:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
reliable; << If RSVP message ID and reliable message delivery are required.
}
}
Starting in Junos 16.1R1, all refresh reduction features are enabled by default. Verify the 'no-reliable' command is configured only if RSVP message ID and reliable message delivery are not required. To enable all refresh reduction features, no commands are necessary.
Junos 16.1R1 and later:
[edit protocols]
rsvp {
interface <interface name>.<logical unit> {
<other configuration>
}
}
If the router with RSVP-TE enabled does not have message pacing configured based on the link speed and input queue size of adjacent core routers, this is a finding.
M
5479