Detections
Analytics
JUNI-RT-000410 - The Juniper out-of-band management (OOBM) gateway router must be configured to have separate IGP instances for the managed network and management network.
Information
If the gateway router is not a dedicated device for the OOBM network, implementation of several safeguards for containment of management and production traffic boundaries must occur. Since the managed and management network are separate routing domains, configuration of separate Interior Gateway Protocol routing instances is critical on the router to segregate traffic from each network.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This requirement is not applicable for the DoDIN Backbone.Configure the router to have a separate IGP instance for the management network as shown in the example below.
[edit routing-instances]
set VRF_MGMT instance-type vrf
set VRF_MGMT route-distinguisher 10.1.12.0:12
set VRF_MGMT vrf-target import target:1234:4567
set VRF_MGMT vrf-target export target:1234:4567
set VRF_MGMT interface ge-1/0/0
set VRF_MGMT interface ge-1/1/0
set VRF_MGMT protocols ospf area 0.0.0.0 interface ge-1/0/0
set VRF_MGMT protocols ospf area 0.0.0.0 interface ge-1/1/0
set VRF_MGMT routing-options router-id 11.11.11.11
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_Router_Y25M01_STIG.zip
Item Details
Audit Name: DISA STIG Juniper Router RTR v3r2
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|II, CCI|CCI-001414, Rule-ID|SV-217046r604135_rule, STIG-ID|JUNI-RT-000410, STIG-Legacy|SV-101087, STIG-Legacy|V-90877, Vuln-ID|V-217046
Plugin: Juniper
Control ID: ae9f5d01ac2450d364002b3b44b5276e8e2bb98464e034097ac1ed4884f1ae33