STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

DISA Rule

SV-254031r997533_rule

Vulnerability Number

V-254031

Group Title

SRG-NET-000362-RTR-000110

Rule Version

JUEX-RT-000590

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Implement control plane protection by classifying traffic types based on importance and configure filters to restrict and rate limit the traffic directed to and processed by the RE according to each class.

set firewall family inet filter <name> term accept-tcp-initial from source-prefix-list management-networks-ipv4
set firewall family inet filter <name> term accept-tcp-initial from destination-prefix-list router-addresses-ipv4
set firewall family inet filter <name> term accept-tcp-initial from protocol tcp
set firewall family inet filter <name> term accept-tcp-initial from destination-port ssh
set firewall family inet filter <name> term accept-tcp-initial from tcp-initial
set firewall family inet filter <name> term accept-tcp-initial then policer policer-32k
set firewall family inet filter <name> term accept-tcp-initial then accept
set firewall family inet filter <name> term accept-ssh from source-prefix-list management-networks-ipv4
set firewall family inet filter <name> term accept-ssh from destination-prefix-list router-addresses-ipv4
set firewall family inet filter <name> term accept-ssh from protocol tcp
set firewall family inet filter <name> term accept-ssh from destination-port ssh
set firewall family inet filter <name> term accept-ssh then policer policer-1g
set firewall family inet filter <name> term accept-ssh then count accept-ssh
set firewall family inet filter <name> term accept-ssh then accept
set firewall family inet filter <name> term accept-snmp from source-prefix-list snmp-servers-ipv4
set firewall family inet filter <name> term accept-snmp from destination-prefix-list router-addresses-ipv4
set firewall family inet filter <name> term accept-snmp from protocol udp
set firewall family inet filter <name> term accept-snmp from destination-port snmp
set firewall family inet filter <name> term accept-snmp then policer policer-1m
set firewall family inet filter <name> term accept-snmp then count accept-snmp
set firewall family inet filter <name> term accept-snmp then accept
<additional terms>
set firewall family inet filter <name> term default-deny then log
set firewall family inet filter <name> term default-deny then syslog
set firewall family inet filter <name> term default-deny then discard

set firewall policer policer-1g if-exceeding bandwidth-limit 1g
set firewall policer policer-1g burst-size-limit 100k
set firewall policer policer-1g then discard
set firewall policer policer-1m if-exceeding bandwidth-limit 1m
set firewall policer policer-1m burst-size-limit 15k
set firewall policer policer-1m then discard
set firewall policer policer-32k if-exceeding bandwidth-limit 132k
set firewall policer policer-32k burst-size-limit 1500
set firewall policer policer-32k then discard

set interfaces lo0 unit <number> family inet filter <name>
set interfaces lo0 unit <number> family inet address <IPv4 address>/32
set interfaces lo0 unit <number> family inet6 filter <name>
set interfaces lo0 unit <number> family inet6 address <IPv6 address>/128

Check Contents

Determine whether control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class.

Verify firewall filters include policers (rate limiting) based upon importance levels. Although the policer names shown in the example are the bandwidth limit, any legal name can be used.

[edit firewall]
family inet {
filter <name> {
term accept-tcp-initial {
from {
source-prefix-list {
management-networks-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol tcp;
destination-port ssh;
tcp-initial;
}
then {
policer policer-32k; << Lower rate for connection attempts to help prevent SYN flood attacks.
accept;
}
}
term accept-ssh {
from {
source-prefix-list {
management-networks-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol tcp;
destination-port ssh;
}
then {
policer policer-1g; << Higher rate after connection establishment for remote management and/or secure file transfer.
accept;
}
}
term accept-snmp {
from {
source-prefix-list {
snmp-servers-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol udp;
destination-port snmp;
}
then {
policer policer-1m;
accept;
}
}
<additional terms>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter <name> {
term accept-tcp-initial {
from {
source-prefix-list {
management-networks-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header tcp;
destination-port ssh;
tcp-initial;
}
then {
policer policer-32k; << Lower rate for connection attempts to help prevent SYN flood attacks.
accept;
}
}
term accept-ssh {
from {
source-prefix-list {
management-networks-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header tcp;
destination-port ssh;
}
then {
policer policer-1g; << Higher rate after connection establishment for remote management.
accept;
}
}
term accept-snmp {
from {
source-prefix-list {
snmp-servers-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header udp;
destination-port snmp;
}
then {
policer policer-1m;
accept;
}
}
<additional terms>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}

Note: Verify the applied filter has terms for all permitted traffic (e.g., OSPF, BGP, etc.).
policer policer-1g {
if-exceeding {
bandwidth-limit 1g;
burst-size-limit 100k;
}
then discard;
}
policer policer-1m {
if-exceeding {
bandwidth-limit 1m;
burst-size-limit 15k;
}
then discard;
}
policer policer-32k {
if-exceeding {
bandwidth-limit 32k;
burst-size-limit 1500;
}
then discard;
}
[edit interfaces]
lo0 {
unit <number> {
family inet {
filter {
input <filter name>;
}
address <IPv4 address>/32;
}
family inet6 {
filter {
input <filter name>;
}
address <IPv6 address>/128/
}
}
}
Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If the router does not have control plane protection implemented, this is a finding.

Vulnerability Number

V-254031

Documentable

False

Rule Version

JUEX-RT-000590

Severity Override Guidance

Determine whether control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class.

Verify firewall filters include policers (rate limiting) based upon importance levels. Although the policer names shown in the example are the bandwidth limit, any legal name can be used.

[edit firewall]
family inet {
filter <name> {
term accept-tcp-initial {
from {
source-prefix-list {
management-networks-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol tcp;
destination-port ssh;
tcp-initial;
}
then {
policer policer-32k; << Lower rate for connection attempts to help prevent SYN flood attacks.
accept;
}
}
term accept-ssh {
from {
source-prefix-list {
management-networks-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol tcp;
destination-port ssh;
}
then {
policer policer-1g; << Higher rate after connection establishment for remote management and/or secure file transfer.
accept;
}
}
term accept-snmp {
from {
source-prefix-list {
snmp-servers-ipv4;
}
destination-prefix-list {
router-addresses-ipv4;
}
protocol udp;
destination-port snmp;
}
then {
policer policer-1m;
accept;
}
}
<additional terms>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}
family inet6 {
filter <name> {
term accept-tcp-initial {
from {
source-prefix-list {
management-networks-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header tcp;
destination-port ssh;
tcp-initial;
}
then {
policer policer-32k; << Lower rate for connection attempts to help prevent SYN flood attacks.
accept;
}
}
term accept-ssh {
from {
source-prefix-list {
management-networks-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header tcp;
destination-port ssh;
}
then {
policer policer-1g; << Higher rate after connection establishment for remote management.
accept;
}
}
term accept-snmp {
from {
source-prefix-list {
snmp-servers-ipv6;
}
destination-prefix-list {
router-addresses-ipv6;
}
next-header udp;
destination-port snmp;
}
then {
policer policer-1m;
accept;
}
}
<additional terms>
term default-deny {
then {
log;
syslog;
discard;
}
}
}
}

Note: Verify the applied filter has terms for all permitted traffic (e.g., OSPF, BGP, etc.).
policer policer-1g {
if-exceeding {
bandwidth-limit 1g;
burst-size-limit 100k;
}
then discard;
}
policer policer-1m {
if-exceeding {
bandwidth-limit 1m;
burst-size-limit 15k;
}
then discard;
}
policer policer-32k {
if-exceeding {
bandwidth-limit 32k;
burst-size-limit 1500;
}
then discard;
}
[edit interfaces]
lo0 {
unit <number> {
family inet {
filter {
input <filter name>;
}
address <IPv4 address>/32;
}
family inet6 {
filter {
input <filter name>;
}
address <IPv6 address>/128/
}
}
}
Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If the router does not have control plane protection implemented, this is a finding.

Check Content Reference

M

Target Key

5479