The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface.
An XCCDF Rule
Description
<VulnDiscussion>Trunked interfaces without an assigned native VLAN do not accept untagged data packets. Allowing trunked interfaces to accept untagged data packets may unintentionally expose VLANs to unauthorized devices that could result in network exploration, unauthorized resource access, or a DoS condition. If a network function requires a native VLAN, and access interfaces are members of the assigned VLAN, authorized devices connected to those interfaces may gain unauthorized access to protected resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-253972r843949_rule
- Severity
- Low
- References
- Updated
Remediation - Manual Procedure
Configure all access interfaces with a VLAN separate from any VLAN configured as native on any trunked interface.
set interfaces <interface name> unit 0 family ethernet-switching interface-mode access
set interfaces <interface name> unit 0 family ethernet-switching vlan members vlan_name
set vlans <vlan_name> vlan-id <VLAN ID not assigned as native to any trunked interface>