Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-253972 | JUEX-L2-000250 | SV-253972r843949_rule | Low |
Description |
---|
Trunked interfaces without an assigned native VLAN do not accept untagged data packets. Allowing trunked interfaces to accept untagged data packets may unintentionally expose VLANs to unauthorized devices that could result in network exploration, unauthorized resource access, or a DoS condition. If a network function requires a native VLAN, and access interfaces are members of the assigned VLAN, authorized devices connected to those interfaces may gain unauthorized access to protected resources. |
STIG | Date |
---|---|
Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide | 2022-08-31 |
Check Text ( C-57424r843947_chk ) |
---|
Review the switch configurations and examine all access interfaces. Verify that they do not belong to any VLAN configured as native for any trunked interface. Example trunked interface with native VLAN ID 30 and an access interface configured for vlan_name: [edit interfaces] native-vlan-id 30; unit 0 { family ethernet-switching { interface-mode trunk; vlan { members [ } } } } unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan_name; } } } } Example VLANs (vlan-id 30 is configured on a trunked interface as native and must not be assigned to access interfaces): [edit vlans] vlan_30 { vlan-id 30; } vlan_name { vlan-id } If trunked interfaces are not configured with a native VLAN ID, this is not a finding. If any trunked interface is configured with a native VLAN ID, and any access interfaces have been assigned to the same VLAN, this is a finding. |
Fix Text (F-57375r843948_fix) |
---|
Configure all access interfaces with a VLAN separate from any VLAN configured as native on any trunked interface. set interfaces set interfaces set vlans |