The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253967	JUEX-L2-000200	SV-253967r843934_rule		Medium

Description
In a switched Ethernet network, some protocols use L2 Protocol Data Units (PDU) to communicate in-band management or other control information. This control traffic is inappropriate for host-facing access interfaces because those devices are not part of the switching infrastructure. Juniper switches do not automatically carry this L2 control traffic in the default VLAN or automatically assign the default VLAN to all trunks, reducing the scope of potential misuse. Preventing host-facing access interfaces from participating in the L2 control traffic communications further reduces the risk of inadvertent (or malicious) interference.

Description

In a switched Ethernet network, some protocols use L2 Protocol Data Units (PDU) to communicate in-band management or other control information. This control traffic is inappropriate for host-facing access interfaces because those devices are not part of the switching infrastructure. Juniper switches do not automatically carry this L2 control traffic in the default VLAN or automatically assign the default VLAN to all trunks, reducing the scope of potential misuse. Preventing host-facing access interfaces from participating in the L2 control traffic communications further reduces the risk of inadvertent (or malicious) interference.

STIG	Date
Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide	2022-08-31

Details

Check Text ( C-57419r843932_chk )
Review the switch configurations and verify all access interfaces are assigned to a configured VLAN not used for L2 control traffic. If assigning via interface-range, the configuration will be similar to the example. [edit interfaces] interface-range { member ; member-range to ; <<< Member ranges are contiguous from to inclusive unit 0 { family ethernet-switching { vlan { members ; } } } } If assigning individually, the configuration will be similar to the example. [edit interfaces] { unit 0 { family ethernet-switching { vlan { members ; } } } } Verify the assigned VLANs are configured. [edit vlans] { vlan-id ; } Note: Assigning interfaces to a VLAN automatically removes them from the default VLAN. If there are access interfaces assigned to the VLANs used for L2 control traffic, this is a finding.

Check Text ( C-57419r843932_chk )

Review the switch configurations and verify all access interfaces are assigned to a configured VLAN not used for L2 control traffic.

If assigning via interface-range, the configuration will be similar to the example.
[edit interfaces]
interface-range {
member ;
member-range to ; <<< Member ranges are contiguous from to inclusive
unit 0 {
family ethernet-switching {
vlan {
members ;
}
}
}
}

If assigning individually, the configuration will be similar to the example.
[edit interfaces]
{
unit 0 {
family ethernet-switching {
vlan {
members ;
}
}
}
}

Verify the assigned VLANs are configured.
[edit vlans]
{
vlan-id ;
}
Note: Assigning interfaces to a VLAN automatically removes them from the default VLAN.

If there are access interfaces assigned to the VLANs used for L2 control traffic, this is a finding.

Fix Text (F-57370r843933_fix)
Assign all access interfaces to a VLAN not used for L2 control traffic. Interface range configuration: set interfaces interface-range name member set interfaces interface-range name member-range to set interfaces interface-range name unit 0 family ethernet-switching vlan members Individual interface configuration: set interfaces unit 0 family ethernet-switching vlan members Configure the VLAN: set vlans vlan-id

Fix Text (F-57370r843933_fix)

Assign all access interfaces to a VLAN not used for L2 control traffic.

Interface range configuration:
set interfaces interface-range name member
set interfaces interface-range name member-range to
set interfaces interface-range name unit 0 family ethernet-switching vlan members

Individual interface configuration:
set interfaces unit 0 family ethernet-switching vlan members

Configure the VLAN:
set vlans vlan-id