STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

DISA Rule

SV-254030r844123_rule

Vulnerability Number

V-254030

Group Title

SRG-NET-000362-RTR-000109

Rule Version

JUEX-RT-000580

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable all configuration auto-loading or zero-touch deployment features.

delete system auto-configuration
delete system phone-home
Note: The "phone-home" command is hidden and must be fully typed into the CLI (autocomplete will not work).

Configure the router with a nondefault configuration and commit.

Check Contents

Review the device configuration to determine if a configuration auto-loading or zero-touch deployment feature is enabled. Verify the Juniper router is not configured with the factory default configuration. The Zero Touch Provisioning (ZTP) feature requires the factory default configuration. Juniper ZTP leverages Dynamic Host Configuration Protocol (DHCP) options to provide not only the interface address, but also the location of the upgrade image and configuration file. Interfaces configured for DHCP will not attempt to establish a ZTP session simply because DHCP is enabled but, instead, also require a factory default configuration. Therefore, if DHCP is authorized, removing the following [edit system] options, setting a root password, and committing will prevent the device from attempting ZTP.

Verify the following are removed.
[edit system]
:
:
auto-configuration; << Delete this command.
phone-home { << Delete this stanza.
server <server URL>;
rfc-compliant;
}

If a configuration auto-loading feature or zero-touch deployment feature is enabled, this is a finding.

Note: Auto-configuration or zero-touch deployment features can be enabled when the router is offline for the purpose of image loading or building out the configuration. In addition, this would not be applicable to the provisioning of virtual routers via a software-defined network (SDN) orchestration system.

Vulnerability Number

V-254030

Documentable

False

Rule Version

JUEX-RT-000580

Severity Override Guidance

Review the device configuration to determine if a configuration auto-loading or zero-touch deployment feature is enabled. Verify the Juniper router is not configured with the factory default configuration. The Zero Touch Provisioning (ZTP) feature requires the factory default configuration. Juniper ZTP leverages Dynamic Host Configuration Protocol (DHCP) options to provide not only the interface address, but also the location of the upgrade image and configuration file. Interfaces configured for DHCP will not attempt to establish a ZTP session simply because DHCP is enabled but, instead, also require a factory default configuration. Therefore, if DHCP is authorized, removing the following [edit system] options, setting a root password, and committing will prevent the device from attempting ZTP.

Verify the following are removed.
[edit system]
:
:
auto-configuration; << Delete this command.
phone-home { << Delete this stanza.
server <server URL>;
rfc-compliant;
}

If a configuration auto-loading feature or zero-touch deployment feature is enabled, this is a finding.

Note: Auto-configuration or zero-touch deployment features can be enabled when the router is offline for the purpose of image loading or building out the configuration. In addition, this would not be applicable to the provisioning of virtual routers via a software-defined network (SDN) orchestration system.

Check Content Reference

M

Target Key

5479