Detections
Analytics
JUEX-RT-000600 - The Juniper router must be configured to have Gratuitous ARP disabled on all external interfaces.
Information
A gratuitous ARP is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed gratuitous ARP message can cause network mapping information to be stored incorrectly, causing network malfunction.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Disable gratuitous ARP on all external interfaces.set interfaces <external interface> no-gratuitous-arp-reply
set interfaces <external interface> no-gratuitous-arp-request
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M01_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Router v2r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-5, CAT|II, CCI|CCI-002385, Rule-ID|SV-254032r844129_rule, STIG-ID|JUEX-RT-000600, Vuln-ID|V-254032
Plugin: Juniper
Control ID: 1ec66fbcacb470e17227eb32306e3e4b91a40b3bc38f457435314ffa4cb452e2