JUEX-RT-000010 - The Juniper router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-253973r843952_rule

STIG-ID|JUEX-RT-000010

Vuln-ID|V-253973

JUEX-RT-000020 - The Juniper BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Rule-ID|SV-253974r843955_rule

STIG-ID|JUEX-RT-000020

Vuln-ID|V-253974

JUEX-RT-000030 - The Juniper BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Rule-ID|SV-253975r843958_rule

STIG-ID|JUEX-RT-000030

Vuln-ID|V-253975

JUEX-RT-000040 - The Juniper BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

Rule-ID|SV-253976r843961_rule

STIG-ID|JUEX-RT-000040

Vuln-ID|V-253976

JUEX-RT-000050 - The Juniper BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

Rule-ID|SV-253977r843964_rule

STIG-ID|JUEX-RT-000050

Vuln-ID|V-253977

JUEX-RT-000060 - The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

800-53|AC-4(8)

CAT|III

CCI|CCI-000032

Rule-ID|SV-253978r945854_rule

STIG-ID|JUEX-RT-000060

Vuln-ID|V-253978

JUEX-RT-000070 - The Juniper router configured for Multicast Source Discovery Protocol (MSDP) must filter received source-active multicast advertisements for any undesirable multicast groups and sources.

Rule-ID|SV-253979r843970_rule

STIG-ID|JUEX-RT-000070

Vuln-ID|V-253979

JUEX-RT-000080 - The Juniper router configured for Multicast Source Discovery Protocol (MSDP) must filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

Rule-ID|SV-253980r843973_rule

STIG-ID|JUEX-RT-000080

Vuln-ID|V-253980

JUEX-RT-000090 - The Juniper router configured for MSDP must limit the amount of source-active messages it accepts on per-peer basis.

Rule-ID|SV-253981r843976_rule

STIG-ID|JUEX-RT-000090

Vuln-ID|V-253981

JUEX-RT-000100 - The Juniper router configured for BGP must reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Rule-ID|SV-253982r945855_rule

STIG-ID|JUEX-RT-000100

Vuln-ID|V-253982

JUEX-RT-000110 - The Juniper router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

CCI|CCI-001414

Rule-ID|SV-253983r843982_rule

STIG-ID|JUEX-RT-000110

Vuln-ID|V-253983

JUEX-RT-000120 - The Juniper router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-253984r843985_rule

STIG-ID|JUEX-RT-000120

Vuln-ID|V-253984

JUEX-RT-000130 - The Juniper router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

Rule-ID|SV-253985r843988_rule

STIG-ID|JUEX-RT-000130

Vuln-ID|V-253985

JUEX-RT-000140 - The Juniper router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

Rule-ID|SV-253986r843991_rule

STIG-ID|JUEX-RT-000140

Vuln-ID|V-253986

JUEX-RT-000150 - The Juniper multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.

Rule-ID|SV-253987r843994_rule

STIG-ID|JUEX-RT-000150

Vuln-ID|V-253987

JUEX-RT-000160 - The Juniper router must be configured to have all inactive interfaces disabled.

Rule-ID|SV-253988r843997_rule

STIG-ID|JUEX-RT-000160

Vuln-ID|V-253988

JUEX-RT-000170 - The Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.

CAT|I

CCI|CCI-004866

Rule-ID|SV-253989r997520_rule

STIG-ID|JUEX-RT-000170

Vuln-ID|V-253989

JUEX-RT-000180 - The Juniper perimeter router must not be configured to be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-253990r844003_rule

STIG-ID|JUEX-RT-000180

Vuln-ID|V-253990

JUEX-RT-000190 - The Juniper perimeter router must not be configured to redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-253991r844006_rule

STIG-ID|JUEX-RT-000190

Vuln-ID|V-253991

JUEX-RT-000200 - The Juniper out-of-band management (OOBM) gateway router must be configured to have separate IGP instances for the managed network and management network.

Rule-ID|SV-253992r844009_rule

STIG-ID|JUEX-RT-000200

Vuln-ID|V-253992

JUEX-RT-000210 - The Juniper out-of-band management (OOBM) gateway router must not be configured to redistribute routes between the management network routing domain and the managed network routing domain.

Rule-ID|SV-253993r844012_rule

STIG-ID|JUEX-RT-000210

Vuln-ID|V-253993

JUEX-RT-000220 - The Juniper multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated Router (DR) for any undesirable multicast groups and sources.

Rule-ID|SV-253994r844015_rule

STIG-ID|JUEX-RT-000220

Vuln-ID|V-253994

JUEX-RT-000230 - The Juniper multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.

Rule-ID|SV-253995r844018_rule

STIG-ID|JUEX-RT-000230

Vuln-ID|V-253995

JUEX-RT-000240 - The Juniper router must be configured to produce audit records containing information to establish where the events occurred.

800-53|AU-3

CCI|CCI-000132

Rule-ID|SV-253996r844021_rule

STIG-ID|JUEX-RT-000240

Vuln-ID|V-253996

JUEX-RT-000250 - The Juniper router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-253997r844024_rule

STIG-ID|JUEX-RT-000250

Vuln-ID|V-253997

JUEX-RT-000260 - The Juniper router must be configured to log all packets that have been dropped.

CCI|CCI-000134

Rule-ID|SV-253998r844027_rule

STIG-ID|JUEX-RT-000260

Vuln-ID|V-253998

JUEX-RT-000270 - The Juniper router must be configured to have all nonessential capabilities disabled.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-253999r844030_rule

STIG-ID|JUEX-RT-000270

Vuln-ID|V-253999

JUEX-RT-000280 - The Juniper router must not be configured to have any feature enabled that calls home to the vendor.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-254000r844033_rule

STIG-ID|JUEX-RT-000280

Vuln-ID|V-254000

JUEX-RT-000290 - The Juniper router must be configured to use encryption for routing protocol authentication.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-254001r844036_rule

STIG-ID|JUEX-RT-000290

Vuln-ID|V-254001

JUEX-RT-000300 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

Rule-ID|SV-254002r904444_rule

STIG-ID|JUEX-RT-000300

Vuln-ID|V-254002

JUEX-RT-000310 - The Juniper PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-254003r844042_rule

STIG-ID|JUEX-RT-000310

Vuln-ID|V-254003

JUEX-RT-000320 - The Juniper MPLS router with RSVP-TE enabled must be configured to enable refresh reduction features.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-254004r844045_rule

STIG-ID|JUEX-RT-000320

Vuln-ID|V-254004

JUEX-RT-000330 - The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

Rule-ID|SV-254005r844048_rule

STIG-ID|JUEX-RT-000330

Vuln-ID|V-254005

JUEX-RT-000340 - The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

Rule-ID|SV-254006r997521_rule

STIG-ID|JUEX-RT-000340

Vuln-ID|V-254006

JUEX-RT-000350 - The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS DODIN Technical Profile.

CCI|CCI-004931

Rule-ID|SV-254007r997522_rule

STIG-ID|JUEX-RT-000350

Vuln-ID|V-254007

JUEX-RT-000360 - The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.

Rule-ID|SV-254008r997523_rule

STIG-ID|JUEX-RT-000360

Vuln-ID|V-254008

JUEX-RT-000370 - The Juniper perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-254009r844060_rule

STIG-ID|JUEX-RT-000370

Vuln-ID|V-254009

JUEX-RT-000380 - The Juniper router must be configured to restrict traffic destined to itself.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-254010r997524_rule

STIG-ID|JUEX-RT-000380

Vuln-ID|V-254010

JUEX-RT-000390 - The Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-254011r997525_rule

STIG-ID|JUEX-RT-000390

Vuln-ID|V-254011

JUEX-RT-000400 - The Juniper perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-254012r844069_rule

STIG-ID|JUEX-RT-000400

Vuln-ID|V-254012

JUEX-RT-000410 - The Juniper perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-254013r844072_rule

STIG-ID|JUEX-RT-000410

Vuln-ID|V-254013

JUEX-RT-000420 - The Juniper perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-254014r844075_rule

STIG-ID|JUEX-RT-000420

Vuln-ID|V-254014

JUEX-RT-000430 - The Juniper BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Rule-ID|SV-254015r844078_rule

STIG-ID|JUEX-RT-000430

Vuln-ID|V-254015

JUEX-RT-000440 - The Juniper PE router must be configured to block any traffic that is destined to IP core infrastructure.

Detections

Analytics

DISA Juniper EX Series Router v2r1

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Informational Update

Miscellaneous

Added

Removed

Detections

Analytics

DISA Juniper EX Series Router v2r1 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Informational Update

Miscellaneous

Added

Removed

DISA Juniper EX Series Router v2r1