STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured to have each VRF with the appropriate Route Distinguisher (RD).

DISA Rule

SV-254066r844231_rule

Vulnerability Number

V-254066

Group Title

SRG-NET-000512-RTR-000007

Rule Version

JUEX-RT-000940

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the correct RD for each VRF.

set routing-instances <name> description <"appropriate description">
set routing-instances <name> instance-type vrf
set routing-instances <name> interface <ce-facing interface>.<logical unit>
set routing-instances <name> route-distinguisher 33:33 << Must match the design plan for "customer 1".
set routing-instances <name> vrf-target cust1:33:33 << Must match the design plan for "customer 1".
set routing-instances <name> vrf-table-label
set routing-instances <name> protocols ospf area <number> interface <ce-facing interface>.<logical unit>

Check Contents

Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM.

Review all VRFs configured on CE-facing interfaces and verify that the proper RD has been configured for each. Assuming the assigned RD for "customer 1" is "33:33", verify the route-distinguisher matches.

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher 33:33; << Must match the design plan for "customer 1".
vrf-target cust1:33:33; << Must match the design plan for "customer 1".
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If the wrong RD has been configured for any VRF, this is a finding.

Vulnerability Number

V-254066

Documentable

False

Rule Version

JUEX-RT-000940

Severity Override Guidance

Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM.

Review all VRFs configured on CE-facing interfaces and verify that the proper RD has been configured for each. Assuming the assigned RD for "customer 1" is "33:33", verify the route-distinguisher matches.

[edit routing-instances]
<instance name> {
description "To customer 1";
instance-type vrf;
interface <ce-facing interface>.<logical unit>;
route-distinguisher 33:33; << Must match the design plan for "customer 1".
vrf-target cust1:33:33; << Must match the design plan for "customer 1".
vrf-table-label;
protocols {
ospf {
area <number> {
interface <ce-facing interface>.<logical unit>;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If the wrong RD has been configured for any VRF, this is a finding.

Check Content Reference

M

Target Key

5479