The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-217024	JUNI-RT-000190	SV-217024r639663_rule		Medium

Description
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2021-02-11

Details

Check Text ( C-18253r296940_chk )
Review the device configuration to determine if it has been configured to ensure the router does not send ICMP Redirect messages out to any external interface. interfaces { ge-1/0/0 { unit 0 { family inet { no-redirects; address 11.1.12.2/24; } } } ge-1/1/0 { unit 0 { family inet { no-redirects; address 11.1.23.2/24; } } } If ICMP Redirect messages are enabled on any external interfaces, this is a finding.

Check Text ( C-18253r296940_chk )

Review the device configuration to determine if it has been configured to ensure the router does not send ICMP Redirect messages out to any external interface.

interfaces {
ge-1/0/0 {
unit 0 {
family inet {
no-redirects;
address 11.1.12.2/24;
}
}
}
ge-1/1/0 {
unit 0 {
family inet {
no-redirects;
address 11.1.23.2/24;
}
}
}

If ICMP Redirect messages are enabled on any external interfaces, this is a finding.

Fix Text (F-18251r296941_fix)
Disable ICMP redirects on all external interfaces as shown in the example below. [edit interfaces] set ge-1/0/0 unit 0 family inet no-redirects set ge-1/1/0 unit 0 family inet no-redirects