STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.

DISA Rule

SV-254034r844135_rule

Vulnerability Number

V-254034

Group Title

SRG-NET-000362-RTR-000113

Rule Version

JUEX-RT-000620

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable ICMP unreachable notifications on all external interfaces.

set policy-options prefix-list router-addresses-ipv4 <external interface address>/32
set policy-options prefix-list router-addresses-ipv4 <internal subnet>/<mask>

set firewall family inet filter <name> term 1 from source-prefix-list router-address-ipv4
set firewall family inet filter <name> term 1 from protocol icmp
set firewall family inet filter <name> term 1 from icmp-type unreachable
set firewall family inet filter <name> term 1 then log
set firewall family inet filter <name> term 1 then syslog
set firewall family inet filter <name> term 1 then discard
<additional terms>
set firewall family inet filter <name> term default then log
set firewall family inet filter <name> term default then syslog
set firewall family inet filter <name> term default then discard

set interfaces <interface name> unit <number> family inet filter output <filter name>
set interfaces <interface name> unit <number> family inet address <IPv4 address>.<mask>

Check Contents

Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP unreachable notifications out to any external interfaces.

[edit policy-options]
prefix-list router-address-ipv4 {
<external interface address>/32;
<internal subnet>/<mask>;
}
[edit firewall family inet]
filter <name> {
term 1 {
from {
source-prefix-list {
router-address-ipv4;
}
protocol icmp;
icmp-type unreachable;
}
then {
log;
syslog;
discard;
}
}
<additional terms>
term default {
then {
log;
syslog;
discard;
}
}
}

[edit interfaces]
<external interface> {
unit <number> {
family inet {
filter {
output <filter name>;
}
address <IPv4 address>/<mask>;
}
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If ICMP unreachable notifications are enabled on any external interfaces, this is a finding.

Vulnerability Number

V-254034

Documentable

False

Rule Version

JUEX-RT-000620

Severity Override Guidance

Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP unreachable notifications out to any external interfaces.

[edit policy-options]
prefix-list router-address-ipv4 {
<external interface address>/32;
<internal subnet>/<mask>;
}
[edit firewall family inet]
filter <name> {
term 1 {
from {
source-prefix-list {
router-address-ipv4;
}
protocol icmp;
icmp-type unreachable;
}
then {
log;
syslog;
discard;
}
}
<additional terms>
term default {
then {
log;
syslog;
discard;
}
}
}

[edit interfaces]
<external interface> {
unit <number> {
family inet {
filter {
output <filter name>;
}
address <IPv4 address>/<mask>;
}
}
}

Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If ICMP unreachable notifications are enabled on any external interfaces, this is a finding.

Check Content Reference

M

Target Key

5479