STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to have Gratuitous ARP disabled on all external interfaces.

DISA Rule

SV-254032r844129_rule

Vulnerability Number

V-254032

Group Title

SRG-NET-000362-RTR-000111

Rule Version

JUEX-RT-000600

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable gratuitous ARP on all external interfaces.

set interfaces <external interface> no-gratuitous-arp-reply
set interfaces <external interface> no-gratuitous-arp-request
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>

Check Contents

Review the configuration to determine if gratuitous ARP is disabled on all external interfaces.
[edit interfaces]
<external interface> {
no-gratuitous-arp-reply;
no-gratuitous-arp-request;
unit <number> {
family inet {
address <IPv4 address>/<mask>;
}
family inet6 {
address <IPv6 address>/<mask>;
}
}
}

If gratuitous ARP is enabled on any external interface, this is a finding.

Vulnerability Number

V-254032

Documentable

False

Rule Version

JUEX-RT-000600

Severity Override Guidance

Review the configuration to determine if gratuitous ARP is disabled on all external interfaces.
[edit interfaces]
<external interface> {
no-gratuitous-arp-reply;
no-gratuitous-arp-request;
unit <number> {
family inet {
address <IPv4 address>/<mask>;
}
family inet6 {
address <IPv6 address>/<mask>;
}
}
}

If gratuitous ARP is enabled on any external interface, this is a finding.

Check Content Reference

M

Target Key

5479