STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

DISA Rule

SV-254005r844048_rule

Vulnerability Number

V-254005

Group Title

SRG-NET-000193-RTR-000002

Rule Version

JUEX-RT-000330

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure storm control for each CE-facing interface deploying VPLS bridge domains. Base the suppression threshold on expected traffic rates plus some additional capacity.

Configure a policer to rate limit traffic providing storm control in accordance with organizational requirements.

set firewall policer <policer name> if-exceeding bandwidth-limit <value> burst-size-limit <value>
set firewall policer <policer name> then discard

Configure the filter providing storm control to specify traffic types and rate limit broadcast, multicast, and unknown unicast storms.

set firewall family vpls filter <filter name> term <term name> from traffic-type broadcast
set firewall family vpls filter <filter name> term <term name> then policer <policer name> accept
set firewall family vpls filter <filter name> term <term name> from traffic-type multicast
set firewall family vpls filter <filter name> term <term name> then policer <policer name> accept
set firewall family vpls filter <filter name> term <term name> from traffic-type unknown-unicast
set firewall family vpls filter <filter name> term <term name> then policer <policer name> accept

Apply the storm control filter to all CE-facing instances deploying VPLS bridge domains.

set routing-instances <instance name> forwarding-options family vpls flood input <filter name>

Check Contents

Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS.

Verify that a stateless firewall filter has been applied to each VPLS routing instances.

[edit]
routing-instances {
<name> {
forwarding-options {
family vpls {
flood {
input <filter name>;
}
}
}
}
}

Verify the filter defines traffic types associated with storm control (i.e., broadcast, multicast, and unknown unicast storms).

firewall {
family vpls {
filter <filter name> {
term <term name> {
from {
traffic-type broadcast;
}
then {
policer <policer name>;
accept;
}
}
term <term name> {
from {
traffic-type multicast;
}
then {
policer <policer name>;
accept;
}
}
term <term name> {
from {
traffic-type unknown-unicast;
}
then {
policer <policer name>;
accept;
}
}
}
}
}

Verify that the policer rate limits in accordance with local requirements.

firewall {
policer <policer name> {
if-exceeding {
bandwidth-limit <value>;
burst-size-limit <value>;
}
then discard;
}
}

Note: Only EX9200-series devices currently support VPLS.

If storm control is not enabled for broadcast traffic, this is a finding.

Vulnerability Number

V-254005

Documentable

False

Rule Version

JUEX-RT-000330

Severity Override Guidance

Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS.

Verify that a stateless firewall filter has been applied to each VPLS routing instances.

[edit]
routing-instances {
<name> {
forwarding-options {
family vpls {
flood {
input <filter name>;
}
}
}
}
}

Verify the filter defines traffic types associated with storm control (i.e., broadcast, multicast, and unknown unicast storms).

firewall {
family vpls {
filter <filter name> {
term <term name> {
from {
traffic-type broadcast;
}
then {
policer <policer name>;
accept;
}
}
term <term name> {
from {
traffic-type multicast;
}
then {
policer <policer name>;
accept;
}
}
term <term name> {
from {
traffic-type unknown-unicast;
}
then {
policer <policer name>;
accept;
}
}
}
}
}

Verify that the policer rate limits in accordance with local requirements.

firewall {
policer <policer name> {
if-exceeding {
bandwidth-limit <value>;
burst-size-limit <value>;
}
then discard;
}
}

Note: Only EX9200-series devices currently support VPLS.

If storm control is not enabled for broadcast traffic, this is a finding.

Check Content Reference

M

Target Key

5479