UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Juniper perimeter router must be configured to block all outbound management traffic.


Overview

Finding ID Version Rule ID IA Controls Severity
V-254049 JUEX-RT-000770 SV-254049r945857_rule Medium
Description
For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.
STIG Date
Juniper EX Series Switches Router Security Technical Implementation Guide 2024-06-10

Details

Check Text ( C-57501r844178_chk )
This requirement is not applicable for the DODIN Backbone.

The perimeter router of the managed network must be configured with a firewall filter on the egress interface to block all management traffic.

[edit firewall]
family inet {
filter {
term block-UDP-MGT-SRC {
from {
protocol udp;
source-port [ snmp snmptrap 2055 9995 9996 ];
}
then {
syslog;
discard;
}
}
term block-TCP-MGT-SRC {
from {
protocol tcp;
source-port [ ssh tacacs ];
}
then {
syslog;
discard;
}
}
term block-UDP-MGT-DST {
from {
protocol udp;
destination-port [ snmp snmptrap 2055 9995 9996 ];
}
then {
syslog;
discard;
}
}
term block-TCP-MGT-DST {
from {
protocol tcp;
destination-port [ ssh tacacs ];
}
then {
syslog;
discard;
}
}

term accept-other {
then accept;
}
}
}
family inet6 {
filter {
term block-UDP-MGT-SRC {
from {
next-header udp;
source-port [ snmp snmptrap 2055 9995 9996 ];
}
then {
syslog;
discard;
}
}
term block-TCP-MGT-SRC {
from {
next-header tcp;
source-port [ ssh tacacs ];
}
then {
syslog;
discard;
}
}
term block-UDP-MGT-DST {
from {
next-header udp;
destination-port [ snmp snmptrap 2055 9995 9996 ];
}
then {
syslog;
discard;
}
}
term block-TCP-MGT-DST {
from {
next-header tcp;
destination-port [ ssh tacacs ];
}
then {
syslog;
discard;
}
}

term accept-other {
then accept;
}
}
}

Note: Some platforms support the "port" match criterion. For those platforms, only a single term is required to flag on both source- and destination-port. For example:
[edit firewall]
family [inet|inet6] {
filter {
term {
from {
:
port [ port1 port2... ];
}
then {
syslog;
discard;
}
}

}
}

Verify the filter is applied to external interfaces.
[edit interfaces]
{
unit {
family inet {
filter {
output ;
}
address /;
}
family inet6 {
filter {
output ;
}
address /;
}
}
}
Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example:

input-list [ permit_mgt permit_routing_protocols default-deny ];

If management traffic is not blocked at the perimeter, this is a finding.
Fix Text (F-57452r844179_fix)
This requirement is not applicable for the DODIN Backbone.

Configure the perimeter router of the managed network with a firewall filter on the egress interface to block all outbound management traffic.

set firewall family inet filter term block-UDP-MGT-SRC from protocol udp
set firewall family inet filter term block-UDP-MGT-SRC from source-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet filter term block-UDP-MGT-SRC then syslog
set firewall family inet filter term block-UDP-MGT-SRC then discard
set firewall family inet filter term block-TCP-MGT-SRC from protocol tcp
set firewall family inet filter term block-TCP-MGT-SRC from source-port [ ssh tacacs ]
set firewall family inet filter term block-TCP-MGT-SRC then syslog
set firewall family inet filter term block-TCP-MGT-SRC then discard
set firewall family inet filter term block-UDP-MGT-DST from protocol udp
set firewall family inet filter term block-UDP-MGT-DST from destination-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet filter term block-UDP-MGT-DST then syslog
set firewall family inet filter term block-UDP-MGT-DST then discard
set firewall family inet filter term block-TCP-MGT-DST from protocol tcp
set firewall family inet filter term block-TCP-MGT-DST from destination-port [ ssh tacacs ]
set firewall family inet filter term block-TCP-MGT-DST then syslog
set firewall family inet filter term block-TCP-MGT-DST then discard

set firewall family inet filter term accept-others then accept

set firewall family inet6 filter term block-UDP-MGT-SRC from next-header udp
set firewall family inet6 filter term block-UDP-MGT-SRC from source-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet6 filter term block-UDP-MGT-SRC then syslog
set firewall family inet6 filter term block-UDP-MGT-SRC then discard
set firewall family inet6 filter term block-TCP-MGT-SRC from next-header tcp
set firewall family inet6 filter term block-TCP-MGT-SRC from source-port [ ssh tacacs ]
set firewall family inet6 filter term block-TCP-MGT-SRC then syslog
set firewall family inet6 filter term block-TCP-MGT-SRC then discard
set firewall family inet6 filter term block-UDP-MGT-DST from next-header udp
set firewall family inet6 filter term block-UDP-MGT-DST from destination-port [ snmp snmptrap 2055 9995 9996 ]
set firewall family inet6 filter term block-UDP-MGT-DST then syslog
set firewall family inet6 filter term block-UDP-MGT-DST then discard
set firewall family inet6 filter term block-TCP-MGT-DST from next-header tcp
set firewall family inet6 filter term block-TCP-MGT-DST from destination-port [ ssh tacacs ]
set firewall family inet6 filter term block-TCP-MGT-DST then syslog
set firewall family inet6 filter term block-TCP-MGT-DST then discard

set firewall family inet6 filter term accept-others then accept

set interfaces unit family inet filter output
set interfaces unit family inet address /
set interfaces unit family inet6 filter output
set interfaces unit family inet6 address /