Juniper Router RTR Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the routing instance with the globally unique VPLS ID assigned for each customer VLAN.
VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer Layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet b...Rule High Severity -
SRG-NET-000193-RTR-000002
Group -
The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic w...Rule Medium Severity -
SRG-NET-000362-RTR-000119
Group -
The Juniper PE router must be configured to implement Protocol Independent Multicast (PIM) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
PIM snooping provides a way to constrain multicast traffic at Layer 2. By monitoring PIM join and prune packets on each interface, the PE router is able to determine interested multicast receivers ...Rule Low Severity -
SRG-NET-000192-RTR-000002
Group -
SRG-NET-000205-RTR-000007
Group -
The Juniper PE router must be configured to block any traffic that is destined to IP core infrastructure.
IP/MPLS networks providing VPN and transit services must provide, at the least, the same level of protection against denial-of-service (DoS) attacks and intrusions as Layer 2 networks. Although the...Rule High Severity -
SRG-NET-000205-RTR-000008
Group -
The Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.
The uRPF feature is a defense against spoofing and denial-of-service (DoS) attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged sou...Rule Medium Severity -
SRG-NET-000205-RTR-000016
Group -
The Juniper PE router must be configured to ignore or block all packets with any IP options.
Packets with IP options are not fast switched and therefore must be punted to the router processor. Hackers who initiate denial-of-service (DoS) attacks on routers commonly send large streams of pa...Rule Medium Severity -
SRG-NET-000193-RTR-000113
Group -
SRG-NET-000193-RTR-000114
Group -
The Juniper P router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.
Different applications have unique requirements and toleration levels for delay, jitter, bandwidth, packet loss, and availability. To manage the multitude of applications and services, a network re...Rule Low Severity -
SRG-NET-000193-RTR-000112
Group -
The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.
DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed denial-of-service (DDoS) attacks are referred to as volumetric attacks and have the objective o...Rule Medium Severity -
SRG-NET-000019-RTR-000003
Group -
The Juniper multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Limiting where, within the network, a given multic...Rule Medium Severity -
SRG-NET-000019-RTR-000004
Group -
SRG-NET-000019-RTR-000005
Group -
The Juniper multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.
If multicast traffic is forwarded beyond the intended boundary, it is possible that it can be intercepted by unauthorized or unintended personnel. Administrative scoped multicast addresses are loc...Rule Low Severity -
SRG-NET-000362-RTR-000120
Group -
The Juniper multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As...Rule Low Severity -
SRG-NET-000019-RTR-000013
Group -
SRG-NET-000019-RTR-000014
Group -
SRG-NET-000362-RTR-000121
Group -
SRG-NET-000364-RTR-000114
Group -
The Juniper multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.
Real-time multicast traffic can entail multiple large flows of data. Large unicast flows tend to be fairly isolated (i.e., someone doing a file download here or there), whereas multicast can have b...Rule Low Severity -
SRG-NET-000364-RTR-000115
Group -
SRG-NET-000362-RTR-000122
Group -
The Juniper multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
The current multicast paradigm can let any host join any multicast group at any time by sending an IGMP or MLD membership report to the DR. In a Protocol Independent Multicast (PIM) Sparse Mode net...Rule Medium Severity -
SRG-NET-000362-RTR-000123
Group -
SRG-NET-000364-RTR-000116
Group -
The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traf...Rule Medium Severity -
SRG-NET-000343-RTR-000002
Group -
The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to authenticate all received MSDP packets.
MSDP peering with customer network routers presents additional risks to the core, whether from a rogue or misconfigured MSDP-enabled router. MSDP password authentication is used to validate each se...Rule Medium Severity -
SRG-NET-000018-RTR-000007
Group -
SRG-NET-000018-RTR-000008
Group -
The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.
To avoid global visibility of local information, there are a number of source-group (S, G) states in a PIM-SM domain that must not be leaked to another domain, such as multicast sources with privat...Rule Low Severity -
SRG-NET-000018-RTR-000009
Group -
SRG-NET-000512-RTR-000011
Group -
SRG-NET-000512-RTR-000014
Group -
The Juniper perimeter router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.
Many of the known attacks in stateless autoconfiguration are defined in RFC 3756 were present in IPv4 ARP attacks. To mitigate these vulnerabilities, links that have no hosts connected such as the ...Rule Medium Severity -
SRG-NET-000512-RTR-000013
Group -
SRG-NET-000364-RTR-000201
Group -
SRG-NET-000364-RTR-000202
Group -
The Juniper perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop header with invalid option type values.
These options are intended to be for the Destination Options header only. The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not...Rule Medium Severity -
SRG-NET-000364-RTR-000203
Group -
SRG-NET-000364-RTR-000204
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.