The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

An XCCDF Rule

Description

<VulnDiscussion>It is possible that a disabled access interface that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-253966r843931_rule
Severity: Medium
References: CCI-000366
Updated: 8 months ago

Disable all access interfaces not in use and assign to an inactive VLAN.

In this example, "vlan_disabled" is the name given to the VLAN for unused interfaces. This VLAN name can be any legal name.

set vlans vlan_disabled vlan-id <VLAN ID>
set interfaces interface-range <name> member <interface name>
set interfaces interface-range <name> member-range <starting interface name> to <ending interface name>
set interfaces interface-range <name> disable
set interfaces interface-range <name> unit 0 family ethernet-switching vlan members vlan_disabled

set interfaces <interface name> disable
set interfaces <interface name> unit 0 family ethernet-switching vlan members vlan_disabled

Delete the unused VLAN from all trunked interfaces.

delete interfaces <trunked interface> unit 0 family ethernet-switching vlan members vlan_disabled

Note: Switch ports configured for 802.1x are exempt from this requirement.

The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

Description

Remediation - Manual Procedure