STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.

DISA Rule

SV-254064r997537_rule

Vulnerability Number

V-254064

Group Title

SRG-NET-000512-RTR-000005

Rule Version

JUEX-RT-000920

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the PE router to have each VRF bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.

set interfaces <ce facing interface> description <"appropriate description">
set interfaces <ce facing interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <ce facing interface> unit <number> family inet6 address <IPv6 address>/<prefix>

set routing-instances <name> description <"appropriate description">
set routing-instances <name> instance-type vrf
set routing-instances <name> interface <ce-facing interface>.<logical unit>
set routing-instances <name> route-distinguisher <Number in (16 bit:32 bit) or (32 bit 'L':16 bit) or (IP address:16 bit) format>
set routing-instances <name> vrf-target <Target community to use in import and export>
set routing-instances <name> vrf-table-label
set routing-instances <name> protocols ospf area <number> interface <ce-facing interface>.<logical unit>

Check Contents

Review the design plan for deploying L3VPN and VRF-lite.

Review all CE-facing interfaces and verify that the proper VRF is defined.
[edit interfaces]
<ce-facing interface> {
description "To customer 1";
unit <number> {
family inet {
address <IPv4 address>/<mask>;
}
family inet6 {
address <IPv6 address>/<prefix>;
}
}
}

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher <Number in (16 bit:32 bit) or (32 bit 'L':16 bit) or (IP address:16 bit) format>;
vrf-target <Target community to use in import and export>;
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If any VRFs are not bound to the appropriate physical or logical interface, this is a finding.

Vulnerability Number

V-254064

Documentable

False

Rule Version

JUEX-RT-000920

Severity Override Guidance

Review the design plan for deploying L3VPN and VRF-lite.

Review all CE-facing interfaces and verify that the proper VRF is defined.
[edit interfaces]
<ce-facing interface> {
description "To customer 1";
unit <number> {
family inet {
address <IPv4 address>/<mask>;
}
family inet6 {
address <IPv6 address>/<prefix>;
}
}
}

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher <Number in (16 bit:32 bit) or (32 bit 'L':16 bit) or (IP address:16 bit) format>;
vrf-target <Target community to use in import and export>;
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If any VRFs are not bound to the appropriate physical or logical interface, this is a finding.

Check Content Reference

M

Target Key

5479