JUSX-AG-000019 - For User Role Firewalls, the Juniper SRX Services Gateway Firewall must employ user attribute-based security policies to enforce approved authorizations for logical access to information and system resources.

CAT|II

CCI|CCI-000213

CCI|CCI-004891

Rule-ID|SV-214518r997541_rule

STIG-ID|JUSX-AG-000019

STIG-Legacy|SV-80493

STIG-Legacy|V-66003

Vuln-ID|V-214518

JUSX-AG-000036 - The Juniper SRX Services Gateway must generate log records when firewall filters, security screens and security policies are invoked and the traffic is denied or restricted.

CCI|CCI-000172

Rule-ID|SV-214519r557389_rule

STIG-ID|JUSX-AG-000036

STIG-Legacy|SV-80793

STIG-Legacy|V-66303

Vuln-ID|V-214519

JUSX-AG-000037 - The Juniper SRX Services Gateway Firewall must generate audit records when unsuccessful attempts to access security zones occur.

Rule-ID|SV-214520r557389_rule

STIG-ID|JUSX-AG-000037

STIG-Legacy|SV-80795

STIG-Legacy|V-66305

Vuln-ID|V-214520

JUSX-AG-000057 - The Juniper SRX Services Gateway Firewall must be configured to support centralized management and configuration of the audit log.

CCI|CCI-001851

Rule-ID|SV-214521r997542_rule

STIG-ID|JUSX-AG-000057

STIG-Legacy|SV-80797

STIG-Legacy|V-66307

Vuln-ID|V-214521

JUSX-AG-000063 - In the event that communications with the Syslog server is lost, the Juniper SRX Services Gateway must continue to queue traffic log records locally.

CCI|CCI-000140

Rule-ID|SV-214522r557389_rule

STIG-ID|JUSX-AG-000063

STIG-Legacy|SV-80799

STIG-Legacy|V-66309

Vuln-ID|V-214522

JUSX-AG-000083 - The Juniper SRX Services Gateway Firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

CCI|CCI-000381

Rule-ID|SV-214523r557389_rule

STIG-ID|JUSX-AG-000083

STIG-Legacy|SV-80801

STIG-Legacy|V-66311

Vuln-ID|V-214523

JUSX-AG-000084 - The Juniper SRX Services Gateway Firewall must not be configured as an NTP server since providing this network service is unrelated to the role as a firewall.

Rule-ID|SV-214524r557389_rule

STIG-ID|JUSX-AG-000084

STIG-Legacy|SV-80803

STIG-Legacy|V-66313

Vuln-ID|V-214524

JUSX-AG-000085 - The Juniper SRX Services Gateway Firewall must not be configured as a DNS proxy since providing this network service is unrelated to the role as a Firewall.

Rule-ID|SV-214525r557389_rule

STIG-ID|JUSX-AG-000085

STIG-Legacy|SV-80805

STIG-Legacy|V-66315

Vuln-ID|V-214525

JUSX-AG-000086 - The Juniper SRX Services Gateway Firewall must not be configured as a DHCP server since providing this network service is unrelated to the role as a Firewall.

Rule-ID|SV-214526r557389_rule

STIG-ID|JUSX-AG-000086

STIG-Legacy|SV-80807

STIG-Legacy|V-66317

Vuln-ID|V-214526

JUSX-AG-000087 - The Juniper SRX Services Gateway Firewall must be configured to prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services, as defined in the PPSM CAL, vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-214527r557389_rule

STIG-ID|JUSX-AG-000087

STIG-Legacy|SV-80809

STIG-Legacy|V-66319

Vuln-ID|V-214527

JUSX-AG-000105 - The Juniper SRX Services Gateway Firewall must terminate all communications sessions associated with user traffic after 15 minutes or less of inactivity.

CCI|CCI-001133

Rule-ID|SV-214528r971530_rule

STIG-ID|JUSX-AG-000105

STIG-Legacy|SV-80811

STIG-Legacy|V-66321

Vuln-ID|V-214528

JUSX-AG-000120 - The Juniper SRX Services Gateway Firewall providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by implementing statistics-based screens - DoS attacks by implementing statistics-based screens.

CAT|I

CCI|CCI-002385

CCI|CCI-004866

Rule-ID|SV-214529r997544_rule

STIG-ID|JUSX-AG-000120

STIG-Legacy|SV-80813

STIG-Legacy|V-66323

Vuln-ID|V-214529

JUSX-AG-000121 - The Juniper SRX Services Gateway Firewall must implement load balancing on the perimeter firewall, at a minimum, to limit the effects of known and unknown types of denial-of-service (DoS) attacks on the network - DoS attacks on the network.

Rule-ID|SV-214530r997546_rule

STIG-ID|JUSX-AG-000121

STIG-Legacy|SV-80815

STIG-Legacy|V-66325

Vuln-ID|V-214530

JUSX-AG-000122 - The Juniper SRX Services Gateway Firewall must protect against known types of denial-of-service (DoS) attacks by implementing signature-based screens - DoS attacks by implementing signature-based screens.

Rule-ID|SV-214531r997548_rule

STIG-ID|JUSX-AG-000122

STIG-Legacy|SV-80817

STIG-Legacy|V-66327

Vuln-ID|V-214531

JUSX-AG-000124 - The Juniper SRX Services Gateway Firewall must block outbound traffic containing known and unknown denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints - DoS attacks against other networks or endpoints.

CCI|CCI-001094

Rule-ID|SV-214532r997549_rule

STIG-ID|JUSX-AG-000124

STIG-Legacy|SV-80819

STIG-Legacy|V-66329

Vuln-ID|V-214532

JUSX-AG-000126 - The Juniper SRX Services Gateway Firewall must only allow inbound communications from organization-defined authorized sources routed to organization-defined authorized destinations.

CCI|CCI-002403

Rule-ID|SV-214533r997550_rule

STIG-ID|JUSX-AG-000126

STIG-Legacy|SV-80821

STIG-Legacy|V-66331

Vuln-ID|V-214533

JUSX-AG-000127 - The Juniper SRX Services Gateway Firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.

CCI|CCI-001126

Rule-ID|SV-214534r557389_rule

STIG-ID|JUSX-AG-000127

STIG-Legacy|SV-80823

STIG-Legacy|V-66333

Vuln-ID|V-214534

JUSX-AG-000128 - The Juniper SRX Services Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

CCI|CCI-001109

Rule-ID|SV-214535r557389_rule

STIG-ID|JUSX-AG-000128

STIG-Legacy|SV-80825

STIG-Legacy|V-66335

Vuln-ID|V-214535

JUSX-AG-000132 - The Juniper SRX Services Gateway Firewall must configure ICMP to meet DoD requirements.

CCI|CCI-001312

Rule-ID|SV-214536r557389_rule

STIG-ID|JUSX-AG-000132

STIG-Legacy|SV-80827

STIG-Legacy|V-66337

Vuln-ID|V-214536

JUSX-AG-000144 - The Juniper SRX Services Gateway Firewall must continuously monitor all inbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002661

Rule-ID|SV-214537r831589_rule

STIG-ID|JUSX-AG-000144

STIG-Legacy|SV-80829

STIG-Legacy|V-66339

Vuln-ID|V-214537

JUSX-AG-000145 - The Juniper SRX Services Gateway Firewall must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002662

Rule-ID|SV-214538r831590_rule

STIG-ID|JUSX-AG-000145

STIG-Legacy|SV-80831

STIG-Legacy|V-66341

Vuln-ID|V-214538

JUSX-AG-000146 - The Juniper SRX Services Gateway Firewall must generate an alert to, at a minimum, the ISSO and ISSM when unusual/unauthorized activities or conditions are detected during continuous monitoring of communications traffic as it traverses inbound or outbound  across internal security boundaries.

CCI|CCI-002664

Rule-ID|SV-214539r971533_rule

STIG-ID|JUSX-AG-000146

STIG-Legacy|SV-80833

STIG-Legacy|V-66343

Vuln-ID|V-214539

JUSX-AG-000147 - The Juniper SRX Services Gateway Firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources are detected.

Rule-ID|SV-214540r971533_rule

STIG-ID|JUSX-AG-000147

STIG-Legacy|SV-80835

STIG-Legacy|V-66345

Vuln-ID|V-214540

JUSX-AG-000150 - The Juniper SRX Services Gateway Firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when DoS incidents are detected.

Detections

Analytics

DISA Juniper SRX Services Gateway ALG v3r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous