STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper perimeter router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

DISA Rule

SV-254073r844252_rule

Vulnerability Number

V-254073

Group Title

SRG-NET-000512-RTR-000014

Rule Version

JUEX-RT-001010

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the router to suppress Router Advertisements on all external IPv6-enabled interfaces.
If IPv6 router advertisements are not used, even for internal interfaces, delete or deactivate the [edit protocols router-advertisement] stanza.

[delete|deactivate] protocols router-advertisement

Delete or deactivate router advertisements on external interfaces.

[delete|deactivate] protocols router-advertisement interface <external interface>

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify Router Advertisements are suppressed on all external IPv6-enabled interfaces. By default, IPv6 router advertisements are disabled. Verify all configured interfaces are not external facing.
[edit protocols]
router-advertisement {
interface <internal interface>.<logical unit> {
managed-configuration;
:
:
prefix <internal IPv6 prefix>;
}
}

If the router is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Vulnerability Number

V-254073

Documentable

False

Rule Version

JUEX-RT-001010

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify Router Advertisements are suppressed on all external IPv6-enabled interfaces. By default, IPv6 router advertisements are disabled. Verify all configured interfaces are not external facing.
[edit protocols]
router-advertisement {
interface <internal interface>.<logical unit> {
managed-configuration;
:
:
prefix <internal IPv6 prefix>;
}
}

If the router is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Check Content Reference

M

Target Key

5479