STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper PE router must be configured to enforce the split-horizon rule for all pseudowires within a Virtual Private LAN Services (VPLS) bridge domain.

DISA Rule

SV-254069r844240_rule

Vulnerability Number

V-254069

Group Title

SRG-NET-000512-RTR-000010

Rule Version

JUEX-RT-000970

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Enable split horizon on all PE routers deploying VPLS in a full-mesh configuration.
There is no fix for full mesh VPLS because Juniper PE devices with VPLS do not support or require a CLI command to enable/disabled split horizon. Split horizon operation cannot be disabled.

For H-VPLS, delete the "local-switching" directive for all inner mesh groups that do not require split horizon be disabled.
delete routing-instances <name> protocols vpls mesh-group <name> local-switching

Check Contents

Review the PE router configuration to verify that split horizon is enabled. By default, Juniper devices configured as PE routers and VPLS enforce split horizon operation. Except for H-VPLS, Juniper devices do not support disabling split horizon operation.

LDP signaled VPLS requires a full mesh topology, which can lead to scaling issues. Hierarchical VPLS (H-VPLS) partitions the VPLS domains into mesh groups, reducing the required number of pseudo wires. However, the inner VPLS domain may require split horizon be disabled. Juniper devices support these scenarios with the "local-switching" command. Ensure mesh groups supporting H-VPLS do not have the "local-switching" directive enabled, unless required, as shown in the following example. Generally, only inner mesh groups (that is, a group "nested" within another) may require split horizon be disabled.

[edit routing-instances <name> protocols vpls]
mesh-group <name> {
:
local-switching;
:
}

Note: Only EX9200-series devices currently support VPLS.

If split horizon is disabled but not required to be, this is a finding.

Note: In a ring VPLS, split horizon is disabled so that a PE router can forward a packet received from one pseudowire to another pseudowire. To prevent the consequential loop, at least one span in the ring would not have a pseudowire for any given VPLS instance.

Vulnerability Number

V-254069

Documentable

False

Rule Version

JUEX-RT-000970

Severity Override Guidance

Review the PE router configuration to verify that split horizon is enabled. By default, Juniper devices configured as PE routers and VPLS enforce split horizon operation. Except for H-VPLS, Juniper devices do not support disabling split horizon operation.

LDP signaled VPLS requires a full mesh topology, which can lead to scaling issues. Hierarchical VPLS (H-VPLS) partitions the VPLS domains into mesh groups, reducing the required number of pseudo wires. However, the inner VPLS domain may require split horizon be disabled. Juniper devices support these scenarios with the "local-switching" command. Ensure mesh groups supporting H-VPLS do not have the "local-switching" directive enabled, unless required, as shown in the following example. Generally, only inner mesh groups (that is, a group "nested" within another) may require split horizon be disabled.

[edit routing-instances <name> protocols vpls]
mesh-group <name> {
:
local-switching;
:
}

Note: Only EX9200-series devices currently support VPLS.

If split horizon is disabled but not required to be, this is a finding.

Note: In a ring VPLS, split horizon is disabled so that a PE router can forward a packet received from one pseudowire to another pseudowire. To prevent the consequential loop, at least one span in the ring would not have a pseudowire for any given VPLS instance.

Check Content Reference

M

Target Key

5479