Ensure REST Service Address is Set to OOB Management Only


The REST API Service Address should be set to OOB Management.


The REST API service allows remote scripts or users to connect to a JUNOS Device and execute RPC commands to operate and configure the device, potentially granting full control if connecting using a privileged account.

To protect the REST API from unauthorized use, access should be restricted to specific network management segments.

By default, when enabled, the REST API listens on port TCP/3000 (for HTTP) or TCP/3443 (for HTTPS) on all IP Addresses configured on the JUNOS Device. The addresses option can be configured with one or more IP Addresses to restrict the REST API to listening only on these addresses.

In Secure Environments, all Management Services including the REST API should be restricted to being access only through the JUNOS Device's dedicate Out of Band Management Interface (fxp0, em0, etc).


Hosts will be unable to connect to the REST API HTTPS Service on any addresses which are not configured.

NOTE: REST does not appear to be configured on the target. This check is not applicable.


To restrict the IP Address/es on which the REST API will listen, enter the following command from the [edit system services rest] hierarchy:

[edit system services rest]
[email protected]# set https addresses <Service IP>

Where <Service IP> is a single IP Address configured on the Device's Out of Band Management Interface.
To add multiple addresses, enter the following command:

[edit system services rest]
[email protected]# set https addresses [<Service IP 1> <Service IP 2> <Service IP ...> ]

To remove a single address from the current list enter the following command:

[edit system services rest]
[email protected]# delete https addresses <Service IP>

Default Value:

By default the REST API is disabled. When enabled, the REST API HTTPS Service listens on all configured IP Addresses.

See Also


Item Details


References: 800-53|AC-6(10), CSCv6|11.4, CSCv7|4.7

Plugin: Juniper

Control ID: 1f00dad7279f50d30b5c55b024924b68b6af8e832dfd4ee7e59a0bf0d0defd95