The Juniper perimeter router must be configured to block all outbound management traffic.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-217043	JUNI-RT-000380	SV-217043r604135_rule		Medium

Description
For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.

Description

For in-band management, the management network must have its own subnet in order to enforce control and access boundaries provided by Layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2022-06-07

Details

Check Text ( C-18272r296997_chk )
This requirement is not applicable for the DoDIN Backbone. The perimeter router of the managed network must be configured with an outbound filter on the egress interface to block all management traffic as shown in the example below. Verify that the router has been configured with an outbound filter as shown in the example below. interfaces { description "NIPRNet"; ge-0/0/0 { unit 0 { family inet { no-redirects; filter { output OUTBOUND_FILTER; } address 10.1.12.2/24; } } } Verify that the outbound filter discard or rejects management traffic as shown in the example below. firewall { family inet { … … … } filter OUTBOUND_FILTER { term BLOCK_TACACS { from { protocol tcp; port tacacs; } then { syslog; discard; } } term BLOCK_SNMP { from { protocol udp; port [ snmp snmptrap ]; } then { syslog; discard; } } term BLOCK_NETFLOW { from { protocol udp; port [ 2055 9995 9996 ]; } } term ALLOW_OTHER { then accept; } } } If management traffic is not blocked at the perimeter, this is a finding.

Check Text ( C-18272r296997_chk )

This requirement is not applicable for the DoDIN Backbone.

The perimeter router of the managed network must be configured with an outbound filter on the egress interface to block all management traffic as shown in the example below.

Verify that the router has been configured with an outbound filter as shown in the example below.

interfaces {
description "NIPRNet";
ge-0/0/0 {
unit 0 {
family inet {
no-redirects;
filter {
output OUTBOUND_FILTER;
}
address 10.1.12.2/24;
}
}
}

Verify that the outbound filter discard or rejects management traffic as shown in the example below.

firewall {
family inet {
…
…
…
}
filter OUTBOUND_FILTER {
term BLOCK_TACACS {
from {
protocol tcp;
port tacacs;
}
then {
syslog;
discard;
}
}
term BLOCK_SNMP {
from {
protocol udp;
port [ snmp snmptrap ];
}
then {
syslog;
discard;
}
}
term BLOCK_NETFLOW {
from {
protocol udp;
port [ 2055 9995 9996 ];
}
}
term ALLOW_OTHER {
then accept;
}
}
}

If management traffic is not blocked at the perimeter, this is a finding.

Fix Text (F-18270r296998_fix)
This requirement is not applicable for the DoDIN Backbone. Configure the perimeter router of the managed network with an outbound filter on the egress interface to block all management traffic. Configure a filter to block egress management traffic. [edit firewall family inet] Set filter OUTBOUND_FILTER term BLOCK_TACACS from protocol tcp port tacacs Set filter OUTBOUND_FILTER term BLOCK_TACACS then syslog discard Set filter OUTBOUND_FILTER term BLOCK_SNMP from protocol udp port [snmp snmptrap] Set filter OUTBOUND_FILTER term BLOCK_SNMP then syslog discard set filter OUTBOUND_FILTER term BLOCK_NETFLOW from protocol udp port [2055 9995 9996] set filter OUTBOUND_FILTER term BLOCK_NETFLOW then syslog discard Configure the external interfaces with the outbound filter. [edit interfaces ge-0/0/0 unit 0 family inet] set filter output OUTBOUND_FILTER

Fix Text (F-18270r296998_fix)

This requirement is not applicable for the DoDIN Backbone.

Configure the perimeter router of the managed network with an outbound filter on the egress interface to block all management traffic.

Configure a filter to block egress management traffic.

[edit firewall family inet]
Set filter OUTBOUND_FILTER term BLOCK_TACACS from protocol tcp port tacacs
Set filter OUTBOUND_FILTER term BLOCK_TACACS then syslog discard
Set filter OUTBOUND_FILTER term BLOCK_SNMP from protocol udp port [snmp snmptrap]
Set filter OUTBOUND_FILTER term BLOCK_SNMP then syslog discard
set filter OUTBOUND_FILTER term BLOCK_NETFLOW from protocol udp port [2055 9995 9996]
set filter OUTBOUND_FILTER term BLOCK_NETFLOW then syslog discard

Configure the external interfaces with the outbound filter.

[edit interfaces ge-0/0/0 unit 0 family inet]
set filter output OUTBOUND_FILTER