STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.

DISA Rule

SV-254068r997539_rule

Vulnerability Number

V-254068

Group Title

SRG-NET-000512-RTR-000009

Rule Version

JUEX-RT-000960

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Assign globally unique VPN IDs for each customer VLAN using VPLS for carrier Ethernet services between multiple sites, and configure the attachment circuits to the appropriate VFI.

set routing-instances <instance name> protocols vpls vpls-id <VPLS ID> neighbor <neighbor address>

Check Contents

Review the implementation plan and the VPN IDs assigned to customer VLANs for the VPLS deployment.

Review the PE router configuration to verify that customer attachment circuits (i.e., VLANs) are associated to the appropriate VPLS ID.

Review the implementation plan and the VPLS IDs assigned to customer VLANs for the VPLS deployment.

Review the PE router configuration to verify that customer attachment circuits are associated to the appropriate routing instance configured for the customers VPLS ID.

[edit]
routing-instances {
<instance name> {
interface <interface name>.<logical unit>;
protocols {
vpls {
vpls-id <VPLS ID>;
neighbor <neighbor address>;
}
}
}
}
}

Note: Only EX9200-series devices currently support VPLS.

If the attachment circuits have not been bound to the appropriate routing-instance with the assigned VPN ID for each associated VLAN, this is a finding.

Vulnerability Number

V-254068

Documentable

False

Rule Version

JUEX-RT-000960

Severity Override Guidance

Review the implementation plan and the VPN IDs assigned to customer VLANs for the VPLS deployment.

Review the PE router configuration to verify that customer attachment circuits (i.e., VLANs) are associated to the appropriate VPLS ID.

Review the implementation plan and the VPLS IDs assigned to customer VLANs for the VPLS deployment.

Review the PE router configuration to verify that customer attachment circuits are associated to the appropriate routing instance configured for the customers VPLS ID.

[edit]
routing-instances {
<instance name> {
interface <interface name>.<logical unit>;
protocols {
vpls {
vpls-id <VPLS ID>;
neighbor <neighbor address>;
}
}
}
}
}

Note: Only EX9200-series devices currently support VPLS.

If the attachment circuits have not been bound to the appropriate routing-instance with the assigned VPN ID for each associated VLAN, this is a finding.

Check Content Reference

M

Target Key

5479