JUEX-L2-000010 - The Juniper EX switch must be configured to disable non-essential capabilities.

800-53|CM-7a.

CAT|I

CCI|CCI-000381

Rule-ID|SV-253948r843877_rule

STIG-ID|JUEX-L2-000010

Vuln-ID|V-253948

JUEX-L2-000020 - The Juniper EX switch must be configured to uniquely identify all network-connected endpoint devices before establishing any connection.

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-253949r843880_rule

STIG-ID|JUEX-L2-000020

Vuln-ID|V-253949

JUEX-L2-000030 - The Juniper layer 2 switch must be configured to disable all dynamic VLAN registration protocols.

800-53|IA-7

CAT|II

CCI|CCI-000803

Rule-ID|SV-253950r843883_rule

STIG-ID|JUEX-L2-000030

Vuln-ID|V-253950

JUEX-L2-000040 - The Juniper EX switch must be configured to manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-253951r843886_rule

STIG-ID|JUEX-L2-000040

Vuln-ID|V-253951

JUEX-L2-000050 - The Juniper EX switch must be configured to permit authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-253952r843889_rule

STIG-ID|JUEX-L2-000050

Vuln-ID|V-253952

JUEX-L2-000060 - The Juniper EX switch must be configured to permit authorized users to remotely view, in real time, all content related to an established user session from a component separate from the layer 2 switch.

800-53|AU-14(3)

CCI|CCI-001920

Rule-ID|SV-253953r843892_rule

STIG-ID|JUEX-L2-000060

Vuln-ID|V-253953

JUEX-L2-000070 - The Juniper EX switch must be configured to authenticate all network-connected endpoint devices before establishing any connection.

CCI|CCI-001958

Rule-ID|SV-253954r843895_rule

STIG-ID|JUEX-L2-000070

Vuln-ID|V-253954

JUEX-L2-000080 - The Juniper EX switch must be configured to enable Root Protection on all interfaces connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-253955r843898_rule

STIG-ID|JUEX-L2-000080

Vuln-ID|V-253955

JUEX-L2-000090 - The Juniper EX switch must be configured to enable BPDU Protection on all user-facing or untrusted access switch ports.

Rule-ID|SV-253956r843901_rule

STIG-ID|JUEX-L2-000090

Vuln-ID|V-253956

JUEX-L2-000100 - The Juniper EX switch must be configured to enable STP Loop Protection on all non-designated STP switch ports.

Rule-ID|SV-253957r843904_rule

STIG-ID|JUEX-L2-000100

Vuln-ID|V-253957

JUEX-L2-000110 - The Juniper EX switch must be configured not to forward unknown unicast traffic to access interfaces.

Rule-ID|SV-253958r843907_rule

STIG-ID|JUEX-L2-000110

Vuln-ID|V-253958

JUEX-L2-000120 - The Juniper EX switch must be configured to enable DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

Rule-ID|SV-253959r843910_rule

STIG-ID|JUEX-L2-000120

Vuln-ID|V-253959

JUEX-L2-000130 - The Juniper EX switch must be configured to enable IP Source Guard on all user-facing or untrusted access VLANs.

Rule-ID|SV-253960r843913_rule

STIG-ID|JUEX-L2-000130

Vuln-ID|V-253960

JUEX-L2-000140 - The Juniper EX switch must be configured to enable Dynamic Address Resolution Protocol (ARP) Inspection (DAI) on all user VLANs.

Rule-ID|SV-253961r843916_rule

STIG-ID|JUEX-L2-000140

Vuln-ID|V-253961

JUEX-L2-000150 - The Juniper EX switch must be configured to enable Storm Control on all host-facing access interfaces.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-253962r843919_rule

STIG-ID|JUEX-L2-000150

Vuln-ID|V-253962

JUEX-L2-000160 - The Juniper EX switch must be configured to enable IGMP or MLD Snooping on all VLANs.

Rule-ID|SV-253963r843922_rule

STIG-ID|JUEX-L2-000160

Vuln-ID|V-253963

JUEX-L2-000170 - If STP is used, the Juniper EX switch must be configured to implement Rapid STP, or Multiple STP, where VLANs span multiple switches with redundant links.

Rule-ID|SV-253964r843925_rule

STIG-ID|JUEX-L2-000170

Vuln-ID|V-253964

JUEX-L2-000180 - The Juniper EX switch must be configured to verify two-way connectivity on all interswitch trunked interfaces.

Rule-ID|SV-253965r843928_rule

STIG-ID|JUEX-L2-000180

Vuln-ID|V-253965

JUEX-L2-000190 - The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

Rule-ID|SV-253966r843931_rule

STIG-ID|JUEX-L2-000190

Vuln-ID|V-253966

JUEX-L2-000200 - The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.

Rule-ID|SV-253967r843934_rule

STIG-ID|JUEX-L2-000200

Vuln-ID|V-253967

JUEX-L2-000210 - The Juniper EX switch must be configured to prune the default VLAN from all trunked interfaces that do not require it.

Rule-ID|SV-253968r843937_rule

STIG-ID|JUEX-L2-000210

Vuln-ID|V-253968

JUEX-L2-000220 - The Juniper EX switch must not use the default VLAN for management traffic.

Rule-ID|SV-253969r843940_rule

STIG-ID|JUEX-L2-000220

Vuln-ID|V-253969

JUEX-L2-000230 - The Juniper EX switch must be configured to set all user-facing or untrusted ports as access interfaces.

Rule-ID|SV-253970r843943_rule

STIG-ID|JUEX-L2-000230

Vuln-ID|V-253970

JUEX-L2-000240 - The Juniper EX switch must not have a native VLAN ID assigned, or have a unique native VLAN ID, for all 802.1q trunk links.

Rule-ID|SV-253971r843946_rule

STIG-ID|JUEX-L2-000240

Vuln-ID|V-253971

JUEX-L2-000250 - The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface.

Detections

Analytics

DISA Juniper EX Series Layer 2 Switch v1r2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous