UCF STIG Viewer Logo

The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface.


Overview

Finding ID Version Rule ID IA Controls Severity
V-253972 JUEX-L2-000250 SV-253972r843949_rule Low
Description
Trunked interfaces without an assigned native VLAN do not accept untagged data packets. Allowing trunked interfaces to accept untagged data packets may unintentionally expose VLANs to unauthorized devices that could result in network exploration, unauthorized resource access, or a DoS condition. If a network function requires a native VLAN, and access interfaces are members of the assigned VLAN, authorized devices connected to those interfaces may gain unauthorized access to protected resources.
STIG Date
Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide 2022-08-31

Details

Check Text ( C-57424r843947_chk )
Review the switch configurations and examine all access interfaces. Verify that they do not belong to any VLAN configured as native for any trunked interface.

Example trunked interface with native VLAN ID 30 and an access interface configured for vlan_name:
[edit interfaces]
{
native-vlan-id 30;
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members [ ... ];
}
}
}
}
{
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members vlan_name;
}
}
}
}

Example VLANs (vlan-id 30 is configured on a trunked interface as native and must not be assigned to access interfaces):
[edit vlans]
vlan_30 {
vlan-id 30;
}
vlan_name {
vlan-id ;
}

If trunked interfaces are not configured with a native VLAN ID, this is not a finding.

If any trunked interface is configured with a native VLAN ID, and any access interfaces have been assigned to the same VLAN, this is a finding.
Fix Text (F-57375r843948_fix)
Configure all access interfaces with a VLAN separate from any VLAN configured as native on any trunked interface.

set interfaces unit 0 family ethernet-switching interface-mode access
set interfaces unit 0 family ethernet-switching vlan members vlan_name

set vlans vlan-id