The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90829	JUNI-RT-000170	SV-101039r1_rule		Medium

Description
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2020-06-04

Details

Check Text ( C-90093r2_chk )
Review the firewall hierarchy configuration to verify that all packets that are not permitted are silently dropped using the discard parameter as shown in the configuration example below. firewall { family inet { … … … } filter FILTER_INBOUND { term ALLOW_XYZ { from { protocol xyz; } then accept; } … … … } term DENY_BY_DEFAULT { then { log; discard; } } } } If ICMP unreachable notifications are sent for packets that are dropped, this is a finding.

Check Text ( C-90093r2_chk )

Review the firewall hierarchy configuration to verify that all packets that are not permitted are silently dropped using the discard parameter as shown in the configuration example below.

firewall {
family inet {
…
…
…
}
filter FILTER_INBOUND {
term ALLOW_XYZ {
from {
protocol xyz;
}
then accept;
}
…
…
…
}
term DENY_BY_DEFAULT {
then {
log;
discard;
}
}
}
}

If ICMP unreachable notifications are sent for packets that are dropped, this is a finding.

Fix Text (F-97137r2_fix)
[edit firewall family inet] set filter FILTER_INBOUND term DENY_BY_DEFAULT then log discard