Detections
Analytics
JUEX-RT-000600 - The Juniper router must be configured to have Gratuitous ARP disabled on all external interfaces.
Information
A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can cause network mapping information to be stored incorrectly, causing network malfunction.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Disable gratuitous ARP on all external interfaces.set interfaces <external interface> no-gratuitous-arp-reply
set interfaces <external interface> no-gratuitous-arp-request
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M07_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Switches Router STIG v2r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-5, CAT|II, CCI|CCI-002385, Rule-ID|SV-254032r844129_rule, STIG-ID|JUEX-RT-000600, Vuln-ID|V-254032
Plugin: Juniper
Control ID: 09f96bfaec56e0dd04b49630deeae764feb16bbaf6cfd40f1a1503cc9dfff6b2