The Juniper EX switch must not use the default VLAN for management traffic.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253969	JUEX-L2-000220	SV-253969r843940_rule		Medium

Description
By default, all unassigned interfaces are placed into the default VLAN and if used for management, could unintentionally expose sensitive traffic or protected resources to unauthorized devices.

STIG	Date
Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide	2022-08-31

Details

Check Text ( C-57421r843938_chk )
Review the switch configuration and verify that the default VLAN is not used to access the switch for management. Verify access interfaces used for management are assigned to an appropriate VLAN as in the example below. [edit interfaces] { unit 0 { family ethernet-switching { interface-mode access; vlan { members ; } } } } If the default VLAN is being used to access the switch, this is a finding.

Check Text ( C-57421r843938_chk )

Review the switch configuration and verify that the default VLAN is not used to access the switch for management.

Verify access interfaces used for management are assigned to an appropriate VLAN as in the example below.
[edit interfaces]
{
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members ;
}
}
}
}

If the default VLAN is being used to access the switch, this is a finding.

Fix Text (F-57372r843939_fix)
Configure the switch for management access to use a VLAN other than the default VLAN. set interfaces unit 0 family ethernet-switching interface-mode access set interfaces unit 0 family ethernet-switching vlan members