Juniper EX Series Switches Router Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-NET-000364-RTR-000205
Group -
The Juniper perimeter router must be configured to drop IPv6 packets containing the NSAP address option within Destination Option header.
The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence coul...Rule Medium Severity -
SRG-NET-000364-RTR-000206
Group -
The Juniper perimeter router must be configured to drop IPv6 packets containing a Hop-by-Hop or Destination Option extension header with an undefined option type.
The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers that it cannot recognize, and hence coul...Rule Medium Severity -
SRG-NET-000512-RTR-000001
Group -
SRG-NET-000512-RTR-000002
Group -
SRG-NET-000512-RTR-000003
Group -
SRG-NET-000512-RTR-000004
Group -
The Juniper MPLS router must be configured to have TTL Propagation disabled.
The head end of the label-switched path (LSP), the label edge router (LER) will decrement the IP packet's time-to-live (TTL) value by one and then copy the value to the MPLS TTL field. At each labe...Rule Medium Severity -
SRG-NET-000512-RTR-000005
Group -
SRG-NET-000512-RTR-000006
Group -
The Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).
The primary security model for an MPLS L3VPN as well as a VRF-lite infrastructure is traffic separation. Each interface can only be associated to one VRF, which is the fundamental framework for tra...Rule High Severity -
SRG-NET-000512-RTR-000008
Group -
SRG-NET-000512-RTR-000009
Group -
The Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.
VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet b...Rule High Severity -
SRG-NET-000512-RTR-000010
Group -
SRG-NET-000512-RTR-000011
Group -
SRG-NET-000512-RTR-000012
Group -
The Juniper router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.
The Neighbor Discovery protocol allows a hop limit value to be advertised by routers in a Router Advertisement message being used by hosts instead of the standardized default value. If a very small...Rule Low Severity -
SRG-NET-000512-RTR-000013
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.