Detections
Analytics
JUEX-RT-000480 - The Juniper out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.
Information
If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This requirement is not applicable for the DODIN Backbone.Ensure that traffic from the managed network is not able to access the OOBM gateway router using either receive path or interface firewall filters.
set policy-options prefix-list OOBM-ipv4 <IPv4 address>/<mask>
set policy-options prefix-list OOBM-ipv6 <IPv6 address>/<prefix>
set firewall family inet filter protect-re-ipv4 term 1 from source-prefix-list OOBM-ipv4
set firewall family inet filter protect-re-ipv4 term 1 from destination-prefix-list router-ipv4
set firewall family inet filter protect-re-ipv4 term 1 then accept
<additional terms for authorized traffic like OSPF or BGP>
set firewall family inet filter protect-re-ipv4 term default then log
set firewall family inet filter protect-re-ipv4 term default then syslog
set firewall family inet filter protect-re-ipv4 term default then discard
set firewall family inet filter protect-re-ipv6 term 1 from source-prefix-list OOBM-ipv6
set firewall family inet filter protect-re-ipv6 term 1 from destination-prefix-list router-ipv6
set firewall family inet filter protect-re-ipv6 term 1 then accept
<additional terms for authorized traffic like OSPF or BGP>
set firewall family inet filter protect-re-ipv6 term default then log
set firewall family inet filter protect-re-ipv6 term default then syslog
set firewall family inet filter protect-re-ipv6 term default then discard
set interfaces lo0 unit 0 family inet filter input protect-re-ipv4
set interfaces lo0 unit 0 family inet address <IPv4 address>/<mask>
set interfaces lo0 unit 0 family inet6 filter input protect-re-ipv6
set interfaces lo0 unit 0 family inet6 address <IPv6 address>/<prefix>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M01_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Router v1r3
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-254020r844093_rule, STIG-ID|JUEX-RT-000480, Vuln-ID|V-254020
Plugin: Juniper
Control ID: b105fb0aecc93490032c61dfbadf915408f4eb32130747fa1a15ca1ad8c2ba9d