STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

DISA Rule

SV-254012r844069_rule

Vulnerability Number

V-254012

Group Title

SRG-NET-000205-RTR-000003

Rule Version

JUEX-RT-000400

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the router to use ingress firewall filters to restrict traffic in accordance with the guidelines contained in DOD Instruction 8551.1 for all services and protocols required for operational commitments.

set policy-options prefix-list inside-addresses-ipv4 <IPv4 subnet>/<mask>
<additional subnets as required>
set policy-options prefix-list inside-addresses-ipv6 <IPv6 subnet>/<prefix>
<additional subnets as required>

set firewall family inet filter inbound-ipv4 term 1 from destination-prefix-list inside-addresses-ipv4
set firewall family inet filter inbound-ipv4 term 1 from protocol tcp
set firewall family inet filter inbound-ipv4 term 1 from destination-port 80
set firewall family inet filter inbound-ipv4 term 1 from destination-port 443
set firewall family inet filter inbound-ipv4 term 1 then accept
<additional terms as required>
set firewall family inet filter inbound-ipv4 term default-deny then log
set firewall family inet filter inbound-ipv4 term default-deny then syslog
set firewall family inet filter inbound-ipv4 term default-deny then discard

set firewall family inet6 filter inbound-ipv6 term 1 from destination-prefix-list inside-addresses-ipv6
set firewall family inet6 filter inbound-ipv6 term 1 from next-header tcp
set firewall family inet6 filter inbound-ipv6 term 1 from destination-port 80
set firewall family inet6 filter inbound-ipv6 term 1 from destination-port 443
set firewall family inet6 filter inbound-ipv6 term 1 then accept
set firewall family inet6 filter inbound-ipv6 term default-deny then log
set firewall family inet6 filter inbound-ipv6 term default-deny then syslog
set firewall family inet6 filter inbound-ipv6 term default-deny then discard

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that the ingress filter is in accordance with DoD 8551. For example, assuming TCP 80 and 443 are permitted inbound:
[edit policy-options]
prefix-list inside-addresses-ipv4 {
<interior IPv4 subnet / mask>;
}
prefix-list inside-addresses-ipv4 {
<interior IPv6 subnet / prefix>;
}
[edit firewall]
family inet {
filter inbound-ipv4 {
term 1 {
from {
destination-prefix-list inside-addresses-ipv4;
protocol tcp;
destination-port [ 80 443 ];
}
then accept;
}
<other terms as required>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter inbound-ipv6 {
term 1 {
from {
destination-prefix-list inside-addresses-ipv6;
next-header tcp;
destination-port [ 80 443 ];
}
then accept;
}
<other terms as required>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}

If the router does not filter traffic in accordance with the guidelines contained in DoD 8551, this is a finding.

Vulnerability Number

V-254012

Documentable

False

Rule Version

JUEX-RT-000400

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that the ingress filter is in accordance with DoD 8551. For example, assuming TCP 80 and 443 are permitted inbound:
[edit policy-options]
prefix-list inside-addresses-ipv4 {
<interior IPv4 subnet / mask>;
}
prefix-list inside-addresses-ipv4 {
<interior IPv6 subnet / prefix>;
}
[edit firewall]
family inet {
filter inbound-ipv4 {
term 1 {
from {
destination-prefix-list inside-addresses-ipv4;
protocol tcp;
destination-port [ 80 443 ];
}
then accept;
}
<other terms as required>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter inbound-ipv6 {
term 1 {
from {
destination-prefix-list inside-addresses-ipv6;
next-header tcp;
destination-port [ 80 443 ];
}
then accept;
}
<other terms as required>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}

If the router does not filter traffic in accordance with the guidelines contained in DoD 8551, this is a finding.

Check Content Reference

M

Target Key

5479