STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to have IP directed broadcast disabled on all interfaces.

DISA Rule

SV-254033r997534_rule

Vulnerability Number

V-254033

Group Title

SRG-NET-000362-RTR-000112

Rule Version

JUEX-RT-000610

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

Disable IP directed broadcasts on all layer 3 interfaces.

delete interfaces <L3 interface> unit <number> family inet targeted-broadcast
delete interfaces irb unit <L3 IRB interface> family inet targeted-broadcast

Check Contents

Review the router configuration to determine if IP directed broadcast is enabled.

By default, IP directed broadcast is disabled on all L3 interfaces, including Integrated Routing and Bridging (IRB) interfaces. Verify "targeted-broadcast" is not enabled as shown.

[edit interfaces]
<L3 interface> {
unit <number> {
family inet {
targeted-broadcast; << Must not be present.
address <IPv4 address>/<mask>;
}
}
}
irb {
unit <number> {
family inet {
targeted-broadcast; << Must not be present.
address <IPv4 address>/<mask>;
}
}
}

If IP directed broadcast is enabled on layer 3 interfaces, this is a finding.

Vulnerability Number

V-254033

Documentable

False

Rule Version

JUEX-RT-000610

Severity Override Guidance

Review the router configuration to determine if IP directed broadcast is enabled.

By default, IP directed broadcast is disabled on all L3 interfaces, including Integrated Routing and Bridging (IRB) interfaces. Verify "targeted-broadcast" is not enabled as shown.

[edit interfaces]
<L3 interface> {
unit <number> {
family inet {
targeted-broadcast; << Must not be present.
address <IPv4 address>/<mask>;
}
}
}
irb {
unit <number> {
family inet {
targeted-broadcast; << Must not be present.
address <IPv4 address>/<mask>;
}
}
}

If IP directed broadcast is enabled on layer 3 interfaces, this is a finding.

Check Content Reference

M

Target Key

5479