Detections
Analytics

JUEX-RT-000160 - The Juniper router must be configured to have all inactive interfaces disabled.

Information

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use.

If an interface is no longer used, the configuration must be deleted and the interface disabled. For logical interfaces, delete those that are on inactive interfaces and delete logical interfaces that are themselves inactive. If the logical interface is no longer necessary for authorized communications, it must be deleted.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Disable inactive interfaces.

delete interfaces <interface name>
-or-
set interfaces <interface name> disable
-or-
set interfaces interface-range DISABLED_INTERFACES member <interface name>
set interfaces interface-range DISABLED_INTERFACES member-range <first interface name> to <last interface name>
set interfaces interface-range DISABLED_INTERFACES disable

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M01_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|III, CCI|CCI-001414, Rule-ID|SV-253988r843997_rule, STIG-ID|JUEX-RT-000160, Vuln-ID|V-253988

Plugin: Juniper

Control ID: 652b56463bd892847e85070f858cc036c62637680c00caea37dbfca34e099ce0