The Juniper EX switch must be configured to prune the default VLAN from all trunked interfaces that do not require it.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-253968 | JUEX-L2-000210 | SV-253968r843937_rule | Medium |
| Description |
|---|
| All unassigned interfaces are placed into the default VLAN and devices connected to enabled, but unassigned interfaces can communicate within that VLAN. Although the default VLAN is not automatically assigned to any trunked interface, if the default VLAN must be trunked or a misconfigured trunk unintentionally includes the default VLAN, unauthorized devices connected to enabled but unassigned access interfaces could gain network connectivity beyond the local switch. |
| STIG | Date |
|---|---|
| Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide | 2022-08-31 |
Details
| Check Text ( C-57420r843935_chk ) |
|---|
| Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it. [edit interfaces] unit 0 { family ethernet-switching { interface-mode trunk; vlan { members [ vlan_name ... vlan_name ]; } } } } If the default VLAN is not pruned from trunk links that should not be transporting frames for that VLAN, this is a finding. |
| Fix Text (F-57371r843936_fix) |
|---|
| Remove unnecessary VLANs from trunked interfaces. delete interfaces |