The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

An XCCDF Rule

Description

It is possible that a disabled access interface that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

ID: SV-253966r997517_rule
Version: JUEX-L2-000190
Severity: Medium
References: CCI-004891
Updated: 24 days ago

Remediation Templates

Disable all access interfaces not in use and assign to an inactive VLAN.

In this example, "vlan_disabled" is the name given to the VLAN for unused interfaces. This VLAN name can be any legal name.

set vlans vlan_disabled vlan-id <VLAN ID>
set interfaces interface-range <name> member <interface name>
set interfaces interface-range <name> member-range <starting interface name> to <ending interface name>
set interfaces interface-range <name> disable
set interfaces interface-range <name> unit 0 family ethernet-switching vlan members vlan_disabled

set interfaces <interface name> disable
set interfaces <interface name> unit 0 family ethernet-switching vlan members vlan_disabled

Delete the unused VLAN from all trunked interfaces.

delete interfaces <trunked interface> unit 0 family ethernet-switching vlan members vlan_disabled

Note: Switch ports configured for 802.1x are exempt from this requirement.

The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

Description

Remediation Templates

A Manual Procedure