STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

DISA Rule

SV-254048r844177_rule

Vulnerability Number

V-254048

Group Title

SRG-NET-000364-RTR-000112

Rule Version

JUEX-RT-000760

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Disable IP Proxy ARP on all external interfaces.

delete interfaces <external interface> unit 0 proxy-arp

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if Proxy ARP is disabled on all external interfaces. By default, Proxy ARP is disabled on all interfaces. Verify "proxy-arp" has not been enabled on external interfaces as shown in the example:

[edit interfaces]
<external interface> {
unit 0 {
proxy-arp [restricted|unrestricted]; << Must not be configured on external interfaces.
<additional configuration>
}
}

If Proxy ARP is enabled on any external interface, this is a finding.

Vulnerability Number

V-254048

Documentable

False

Rule Version

JUEX-RT-000760

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if Proxy ARP is disabled on all external interfaces. By default, Proxy ARP is disabled on all interfaces. Verify "proxy-arp" has not been enabled on external interfaces as shown in the example:

[edit interfaces]
<external interface> {
unit 0 {
proxy-arp [restricted|unrestricted]; << Must not be configured on external interfaces.
<additional configuration>
}
}

If Proxy ARP is enabled on any external interface, this is a finding.

Check Content Reference

M

Target Key

5479