The Juniper perimeter router must be configured to block all outbound management traffic.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-254049 | JUEX-RT-000770 | SV-254049r844180_rule | Medium |
| Description |
|---|
| For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes as that used for production or operational traffic. Safeguards must be implemented to ensure that the management traffic does not leak past the perimeter of the managed network. |
| STIG | Date |
|---|---|
| Juniper EX Series Switches Router Security Technical Implementation Guide | 2023-03-23 |
Details
| Check Text ( C-57501r844178_chk ) |
|---|
| This requirement is not applicable for the DODIN Backbone. The perimeter router of the managed network must be configured with a firewall filter on the egress interface to block all management traffic. [edit firewall] family inet { filter term block-UDP-MGT-SRC { from { protocol udp; source-port [ snmp snmptrap 2055 9995 9996 ]; } then { syslog; discard; } } term block-TCP-MGT-SRC { from { protocol tcp; source-port [ ssh tacacs ]; } then { syslog; discard; } } term block-UDP-MGT-DST { from { protocol udp; destination-port [ snmp snmptrap 2055 9995 9996 ]; } then { syslog; discard; } } term block-TCP-MGT-DST { from { protocol tcp; destination-port [ ssh tacacs ]; } then { syslog; discard; } } term accept-other { then accept; } } } family inet6 { filter term block-UDP-MGT-SRC { from { next-header udp; source-port [ snmp snmptrap 2055 9995 9996 ]; } then { syslog; discard; } } term block-TCP-MGT-SRC { from { next-header tcp; source-port [ ssh tacacs ]; } then { syslog; discard; } } term block-UDP-MGT-DST { from { next-header udp; destination-port [ snmp snmptrap 2055 9995 9996 ]; } then { syslog; discard; } } term block-TCP-MGT-DST { from { next-header tcp; destination-port [ ssh tacacs ]; } then { syslog; discard; } } term accept-other { then accept; } } } Note: Some platforms support the "port" match criterion. For those platforms, only a single term is required to flag on both source- and destination-port. For example: [edit firewall] family [inet|inet6] { filter term from { : port [ port1 port2... ]; } then { syslog; discard; } } } } Verify the filter is applied to external interfaces. [edit interfaces] unit family inet { filter { output } address } family inet6 { filter { output } address } } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example: input-list [ permit_mgt permit_routing_protocols default-deny ]; If management traffic is not blocked at the perimeter, this is a finding. |
| Fix Text (F-57452r844179_fix) |
|---|
| This requirement is not applicable for the DODIN Backbone. Configure the perimeter router of the managed network with a firewall filter on the egress interface to block all outbound management traffic. set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set firewall family inet6 filter set interfaces set interfaces set interfaces set interfaces |