The Juniper router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253983	JUEX-RT-000110	SV-253983r843982_rule		Low

Description
The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using an authorized MFA token and granted access to the appropriate maintenance port; thus, the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.

Description

The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using an authorized MFA token and granted access to the appropriate maintenance port; thus, the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2023-03-23

Details

Check Text ( C-57435r843980_chk )
Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it. The Junos auxiliary port is disabled by default. Verify the auxiliary port is not configured (there will be no [edit system ports auxiliary] stanza) or that the auxiliary port is explicitly disabled. [edit system ports] auxiliary { disable; } If the auxiliary port is not disabled or is not connected to a secured modem when it is enabled, this is a finding.

Check Text ( C-57435r843980_chk )

Review the configuration and verify that the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected to it.

The Junos auxiliary port is disabled by default. Verify the auxiliary port is not configured (there will be no [edit system ports auxiliary] stanza) or that the auxiliary port is explicitly disabled.

[edit system ports]
auxiliary {
disable;
}

If the auxiliary port is not disabled or is not connected to a secured modem when it is enabled, this is a finding.

Fix Text (F-57386r843981_fix)
Disable the auxiliary port. set system ports auxiliary disable -or- delete system ports auxiliary If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.