Detections
Analytics
JUEX-RT-000170 - The Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.
Information
Enclaves with alternate gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's alternate gateway, the perimeter router could be routing transit data from the internet into the NIPRNet. This could also make the perimeter router vulnerable to a denial-of-service (DoS) attack as well as provide a back door into the NIPRNet. The DoD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approved Gateway is secure through filters permitting packets with a destination address belonging to the DoD enclave's address block.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This requirement is not applicable for the DODIN Backbone.Configure the ingress filter of the perimeter router connected to an alternate gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternate gateway network service provider. For example:
set policy-options prefix-list inside_addresses-ipv4 <IPv4 subnet / mask>
set policy-options prefix-list inside_addresses-ipv6 <IPv6 subnet / prefix>
set firewall family inet filter inbound-ipv4 <deny terms>
set firewall family inet filter inbound-ipv4 <permit term> from <match conditions>
set firewall family inet filter inbound-ipv4 <permit term> from destination-prefix-list inside_addresses-ipv4
set firewall family inet filter inbound-ipv4 <permit term> then accept
set firewall family inet6 filter inbound-ipv6 <deny terms>
set firewall family inet6 filter inbound-ipv6 <permit term> from <match conditions>
set firewall family inet6 filter inbound-ipv6 <permit term> from destination-prefix-list inside_addresses-ipv6
set firewall family inet6 filter inbound-ipv6 <permit term> then accept
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M01_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Router v1r3
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|I, CCI|CCI-001414, Rule-ID|SV-253989r844000_rule, STIG-ID|JUEX-RT-000170, Vuln-ID|V-253989
Plugin: Juniper
Control ID: 960f7700819f7a0ae6f077c1750c5ad0abf3a4a1d03d914fff457a1ba3cb3d35