The Juniper PE or P router must be configured to implement a Quality-of-Service (QoS) policy in accordance with the QoS DoDIN Technical Profile.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90941	JUNI-RT-000750	SV-101151r1_rule		Low

Description
Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy. Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.

Description

Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network requires a QoS framework to differentiate traffic and provide a method to manage network congestion. The Differentiated Services Model (DiffServ) is based on per-hop behavior by categorizing traffic into different classes and enabling each node to enforce a forwarding treatment to each packet as dictated by a policy. Packet markings such as IP Precedence and its successor, Differentiated Services Code Points (DSCP), were defined along with specific per-hop behaviors for key traffic types to enable a scalable QoS solution. DiffServ QoS categorizes network traffic, prioritizes it according to its relative importance, and provides priority treatment based on the classification. It is imperative that end-to-end QoS is implemented within the IP core network to provide preferred treatment for mission-critical applications.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2018-11-15

Details

Check Text ( C-90205r2_chk )
Since PE routers have classified traffic types and set DSCP values for packets received from CE routers, all P routers must be configured to use the configured or default Behavior Aggregate (BA) classifier on all interfaces as shown in the example below. PE routers must be configured to use the same BA classifier on all core-facing interfaces. class-of-service { … … … } interfaces { ge-0/0/1 { unit 0 { classifiers { dscp default; } } } ge-0/1/0 { unit 0 { classifiers { dscp default; } } } ge-1/0/1 { unit 0 { classifiers { dscp default; } } } ge-1/1/0 { unit 0 { classifiers { dscp default; } } } If the router is not configured to implement a QoS policy in accordance with the QoS DoDIN Technical Profile, this is a finding.

Check Text ( C-90205r2_chk )

Since PE routers have classified traffic types and set DSCP values for packets received from CE routers, all P routers must be configured to use the configured or default Behavior Aggregate (BA) classifier on all interfaces as shown in the example below. PE routers must be configured to use the same BA classifier on all core-facing interfaces.

class-of-service {
…
…
…
}
interfaces {
ge-0/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-0/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}

If the router is not configured to implement a QoS policy in accordance with the QoS DoDIN Technical Profile, this is a finding.

Fix Text (F-97249r2_fix)
Configure all P router interfaces and PE core-facing interfaces to use a configured or the default BA classifier as shown in the example below. [edit class-of-service interfaces] set ge-0/0/1 unit 0 classifiers dscp default set ge-0/1/0 unit 0 classifiers dscp default set ge-1/0/1 unit 0 classifiers dscp default set ge-1/1/0 unit 0 classifiers dscp default