STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode, or a firewall filter, enabled on all CE-facing interfaces.

DISA Rule

SV-254017r997527_rule

Vulnerability Number

V-254017

Group Title

SRG-NET-000205-RTR-000008

Rule Version

JUEX-RT-000450

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

Enable uRPF loose mode or apply an ingress filter on all CE-facing interfaces.

For example, configure uRPF on CE-facing interfaces:
set interfaces ge-0/0/0 unit 0 family inet rpf-check mode loose
set interfaces ge-0/0/0 unit 0 family inet6 rpf-check mode loose

For example, configure firewall filter and apply to CE-facing interfaces (only for devices that do not support uRPF):
set policy-options prefix-list cust1-prefixes-ipv4 192.0.2.0/24
set policy-options prefix-list cust1-prefixes-ipv6 2001:db8:2::/64

set firewall family inet filter cust1-prefixes-ipv4 term 1 from source-prefix-list cust1-prefixes-ipv4
set firewall family inet filter cust1-prefixes-ipv4 term 1 then accept
set firewall family inet filter cust1-prefixes-ipv4 term default then log
set firewall family inet filter cust1-prefixes-ipv4 term default then syslog
set firewall family inet filter cust1-prefixes-ipv4 term default then discard
set firewall family inet6 filter cust1-prefixes-ipv6 term 1 from source-prefix-list cust1-prefixes-ipv6
set firewall family inet6 filter cust1-prefixes-ipv6 term 1 then accept
set firewall family inet6 filter cust1-prefixes-ipv6 term default then log
set firewall family inet6 filter cust1-prefixes-ipv6 term default then syslog
set firewall family inet6 filter cust1-prefixes-ipv6 term default then discard

set interfaces ge-0/0/0 unit 0 family inet filter input cust1-prefixes-ipv4
set interfaces ge-0/0/0 unit 0 family inet6 filter input cust1-prefixes-ipv6

Check Contents

Review the PE router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces.

[edit interfaces]
ge-0/0/12 {
unit 0 {
family inet {
rpf-check {
mode loose;
}
address <IPv4 address>/<mask>;
}
family inet6 {
rpf-check {
mode loose;
}
address <IPv6 address>/<prefix>;
}
}
}

For those platforms that do not support uRPF, verify an ingress stateless firewall filter is applied to all CE-facing interfaces. Because the prefixes assigned to each customer is known, verify each customer's prefix list contains only their prefixes and is referenced in an appropriate firewall filter. For example:
[edit policy-options]
prefix-list cust1-prefixes-ipv4 {
192.0.2.0/24;
}
prefix-list cust1-prefixes-ipv6 {
2001:db8:2::/64;
}
[edit firewall]
family inet {
filter cust1-prefixes-ipv4 {
term 1 {
from {
source-prefix-list {
cust1-prefixes-ipv4;
}
}
then accept;
}
term default {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter cust1-prefixes-ipv6 {
term 1 {
from {
source-prefix-list {
cust1-prefixes-ipv6;
}
}
then accept;
}
term default {
then {
log;
syslog;
discard;
}
}
}
}

Verify the appropriate filter is applied to each CE-facing interface. For example:
[edit interfaces]
ge-0/0/0 {
unit 0 {
family inet {
filter {
input cust1-prefixes-ipv4;
}
address <IPv4 address>/<mask>;
}
family inet6 {
filter {
input cust1-prefixes-ipv6;
}
address <IPv6 address>/<prefix>;
}
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If uRPF or an ingress firewall filter is not enabled on all CE-facing interfaces, this is a finding.

Vulnerability Number

V-254017

Documentable

False

Rule Version

JUEX-RT-000450

Severity Override Guidance

Review the PE router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces.

[edit interfaces]
ge-0/0/12 {
unit 0 {
family inet {
rpf-check {
mode loose;
}
address <IPv4 address>/<mask>;
}
family inet6 {
rpf-check {
mode loose;
}
address <IPv6 address>/<prefix>;
}
}
}

For those platforms that do not support uRPF, verify an ingress stateless firewall filter is applied to all CE-facing interfaces. Because the prefixes assigned to each customer is known, verify each customer's prefix list contains only their prefixes and is referenced in an appropriate firewall filter. For example:
[edit policy-options]
prefix-list cust1-prefixes-ipv4 {
192.0.2.0/24;
}
prefix-list cust1-prefixes-ipv6 {
2001:db8:2::/64;
}
[edit firewall]
family inet {
filter cust1-prefixes-ipv4 {
term 1 {
from {
source-prefix-list {
cust1-prefixes-ipv4;
}
}
then accept;
}
term default {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter cust1-prefixes-ipv6 {
term 1 {
from {
source-prefix-list {
cust1-prefixes-ipv6;
}
}
then accept;
}
term default {
then {
log;
syslog;
discard;
}
}
}
}

Verify the appropriate filter is applied to each CE-facing interface. For example:
[edit interfaces]
ge-0/0/0 {
unit 0 {
family inet {
filter {
input cust1-prefixes-ipv4;
}
address <IPv4 address>/<mask>;
}
family inet6 {
filter {
input cust1-prefixes-ipv6;
}
address <IPv6 address>/<prefix>;
}
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If uRPF or an ingress firewall filter is not enabled on all CE-facing interfaces, this is a finding.

Check Content Reference

M

Target Key

5479