The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254005	JUEX-RT-000330	SV-254005r844048_rule		Medium

Description
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.

Description

A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2023-03-23

Details

Check Text ( C-57457r844046_chk )
Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS. Verify that a stateless firewall filter has been applied to each VPLS routing instances. [edit] routing-instances { { forwarding-options { family vpls { flood { input ; } } } } } Verify the filter defines traffic types associated with storm control (i.e., broadcast, multicast, and unknown unicast storms). firewall { family vpls { filter { term { from { traffic-type broadcast; } then { policer ; accept; } } term { from { traffic-type multicast; } then { policer ; accept; } } term { from { traffic-type unknown-unicast; } then { policer ; accept; } } } } } Verify that the policer rate limits in accordance with local requirements. firewall { policer { if-exceeding { bandwidth-limit ; burst-size-limit ; } then discard; } } Note: Only EX9200-series devices currently support VPLS. If storm control is not enabled for broadcast traffic, this is a finding.

Check Text ( C-57457r844046_chk )

Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS.

Verify that a stateless firewall filter has been applied to each VPLS routing instances.

[edit]
routing-instances {
{
forwarding-options {
family vpls {
flood {
input ;
}
}
}
}
}

Verify the filter defines traffic types associated with storm control (i.e., broadcast, multicast, and unknown unicast storms).

firewall {
family vpls {
filter {
term {
from {
traffic-type broadcast;
}
then {
policer ;
accept;
}
}
term {
from {
traffic-type multicast;
}
then {
policer ;
accept;
}
}
term {
from {
traffic-type unknown-unicast;
}
then {
policer ;
accept;
}
}
}
}
}

Verify that the policer rate limits in accordance with local requirements.

firewall {
policer {
if-exceeding {
bandwidth-limit ;
burst-size-limit ;
}
then discard;
}
}

Note: Only EX9200-series devices currently support VPLS.

If storm control is not enabled for broadcast traffic, this is a finding.

Fix Text (F-57408r844047_fix)
Configure storm control for each CE-facing interface deploying VPLS bridge domains. Base the suppression threshold on expected traffic rates plus some additional capacity. Configure a policer to rate limit traffic providing storm control in accordance with organizational requirements. set firewall policer if-exceeding bandwidth-limit burst-size-limit set firewall policer then discard Configure the filter providing storm control to specify traffic types and rate limit broadcast, multicast, and unknown unicast storms. set firewall family vpls filter term from traffic-type broadcast set firewall family vpls filter term then policer accept set firewall family vpls filter term from traffic-type multicast set firewall family vpls filter term then policer accept set firewall family vpls filter term from traffic-type unknown-unicast set firewall family vpls filter term then policer accept Apply the storm control filter to all CE-facing instances deploying VPLS bridge domains. set routing-instances forwarding-options family vpls flood input

Fix Text (F-57408r844047_fix)

Configure storm control for each CE-facing interface deploying VPLS bridge domains. Base the suppression threshold on expected traffic rates plus some additional capacity.

Configure a policer to rate limit traffic providing storm control in accordance with organizational requirements.

set firewall policer if-exceeding bandwidth-limit burst-size-limit
set firewall policer then discard

Configure the filter providing storm control to specify traffic types and rate limit broadcast, multicast, and unknown unicast storms.

set firewall family vpls filter term from traffic-type broadcast
set firewall family vpls filter term then policer accept
set firewall family vpls filter term from traffic-type multicast
set firewall family vpls filter term then policer accept
set firewall family vpls filter term from traffic-type unknown-unicast
set firewall family vpls filter term then policer accept

Apply the storm control filter to all CE-facing instances deploying VPLS bridge domains.

set routing-instances forwarding-options family vpls flood input