STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).

DISA Rule

SV-254065r997538_rule

Vulnerability Number

V-254065

Group Title

SRG-NET-000512-RTR-000006

Rule Version

JUEX-RT-000930

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure all J-PE routers to have the correct VRF defined with the appropriate RT.

set routing-instances <name> description <"appropriate description">
set routing-instances <name> instance-type vrf
set routing-instances <name> interface <ce-facing interface>.<logical unit>
set routing-instances <name> route-distinguisher 33:33 << Must match the design plan for "customer 1".
set routing-instances <name> vrf-target cust1:33:33 << Must match the design plan for "customer 1".
set routing-instances <name> vrf-table-label
set routing-instances <name> protocols ospf area <number> interface <ce-facing interface>.<logical unit>

Check Contents

Verify that the correct RT is configured for each VRF.

Review the design plan for MPLS/L3VPN and VRF-lite to determine what RTs have been assigned for each VRF.

Review the route-distinguisher and vrf-target statements under each configured VRF and verify that the correct RTs have been defined for each VRF. Assuming the assigned RT for "customer 1" is "cust1:33:33", verify vrf-target matches.

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher 33:33; << Must match the design plan for "customer 1".
vrf-target cust1:33:33; << Must match the design plan for "customer 1".
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If there are VRFs configured with the wrong RT, this is a finding.

Vulnerability Number

V-254065

Documentable

False

Rule Version

JUEX-RT-000930

Severity Override Guidance

Verify that the correct RT is configured for each VRF.

Review the design plan for MPLS/L3VPN and VRF-lite to determine what RTs have been assigned for each VRF.

Review the route-distinguisher and vrf-target statements under each configured VRF and verify that the correct RTs have been defined for each VRF. Assuming the assigned RT for "customer 1" is "cust1:33:33", verify vrf-target matches.

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher 33:33; << Must match the design plan for "customer 1".
vrf-target cust1:33:33; << Must match the design plan for "customer 1".
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If there are VRFs configured with the wrong RT, this is a finding.

Check Content Reference

M

Target Key

5479