STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper perimeter router must be configured to drop fragmented IPv6 packets where the first fragment does not include the entire IPv6 header chain.

DISA Rule

SV-254053r950991_rule

Vulnerability Number

V-254053

Group Title

SRG-NET-000364-RTR-000200

Rule Version

JUEX-RT-000810

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the router to drop first-fragment IPv6 packets without the entire header chain.

There is no configurable CLI option to prevent EX devices from dropping nonconformant fragmented IPv6 packets destined to the device.

Configure the router to drop fragmented transit IPv6 packets.

set firewall family inet6 filter <name> term <name> from next-header fragment
set firewall family inet6 filter <name> term <name> then syslog
set firewall family inet6 filter <name> term <name> then discard

Check Contents

This requirement is not applicable for the DODIN Backbone.

There is no check for dropping RFC 7112 nonconformant fragmented IPv6 packets because Juniper EX switches drop these packets without offering or requiring a configurable option in the CLI.

Review the router configuration to determine if it is configured to drop fragmented transit IPv6 traffic.

[edit firewall family inet6]
filter <filter name> {
term <name> {
from {
next-header fragment;
}
then {
syslog;
discard;
}
}
}

Note: Some platforms also support "is-fragment" or "fragment-flags is-fragment" in addition to "next-header fragment" as shown in the example.

If the router is not configured to drop first-fragment IPv6 packets without the entire header chain, this is a finding.

Vulnerability Number

V-254053

Documentable

False

Rule Version

JUEX-RT-000810

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

There is no check for dropping RFC 7112 nonconformant fragmented IPv6 packets because Juniper EX switches drop these packets without offering or requiring a configurable option in the CLI.

Review the router configuration to determine if it is configured to drop fragmented transit IPv6 traffic.

[edit firewall family inet6]
filter <filter name> {
term <name> {
from {
next-header fragment;
}
then {
syslog;
discard;
}
}
}

Note: Some platforms also support "is-fragment" or "fragment-flags is-fragment" in addition to "next-header fragment" as shown in the example.

If the router is not configured to drop first-fragment IPv6 packets without the entire header chain, this is a finding.

Check Content Reference

M

Target Key

5479