The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254036	JUEX-RT-000640	SV-254036r844141_rule		Medium

Description
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-57488r844139_chk )
Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP Redirect messages out to any external interfaces. Verify the global "no-redirects" statement is enabled under [edit system] or that individual interface "no-redirects" statements are configured on external interfaces. [edit system] no-redirects; [edit interfaces] { unit { family inet { no-redirects; address .; } family inet6 { no-redirects; address .; } } } If ICMP Redirect messages are enabled on any external interfaces, this is a finding.

Check Text ( C-57488r844139_chk )

Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP Redirect messages out to any external interfaces.

Verify the global "no-redirects" statement is enabled under [edit system] or that individual interface "no-redirects" statements are configured on external interfaces.
[edit system]
no-redirects;
[edit interfaces]
{
unit {
family inet {
no-redirects;
address .;
}
family inet6 {
no-redirects;
address .;
}
}
}

If ICMP Redirect messages are enabled on any external interfaces, this is a finding.

Fix Text (F-57439r844140_fix)
Disable ICMP redirects on all external interfaces. set system no-redirects set interfaces unit family inet no-redirects set interfaces unit family inet6 no-redirects