The Juniper PE router must be configured to have each VRF with the appropriate Route Distinguisher (RD).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254066	JUEX-RT-000940	SV-254066r844231_rule		Medium

Description
An RD provides uniqueness to the customer address spaces within the MPLS L3VPN infrastructure. The concept of the VPN-IPv4 and VPN-IPv6 address families consists of the RD prepended before the IP address. Hence, if the same IP prefix is used in several different L3VPNs, it is possible for BGP to carry several completely different routes for that prefix, one for each VPN. Since VPN-IPv4 addresses and IPv4 addresses are different address families, BGP never treats them as comparable addresses. The purpose of the RD is to create distinct routes for common IPv4 address prefixes. On any given PE router, a single RD can define a VRF in which the entire address space may be used independently, regardless of the makeup of other VPN address spaces. Hence, it is imperative that a unique RD is assigned to each L3VPN and that the proper RD is configured for each VRF.

Description

An RD provides uniqueness to the customer address spaces within the MPLS L3VPN infrastructure. The concept of the VPN-IPv4 and VPN-IPv6 address families consists of the RD prepended before the IP address. Hence, if the same IP prefix is used in several different L3VPNs, it is possible for BGP to carry several completely different routes for that prefix, one for each VPN. Since VPN-IPv4 addresses and IPv4 addresses are different address families, BGP never treats them as comparable addresses. The purpose of the RD is to create distinct routes for common IPv4 address prefixes. On any given PE router, a single RD can define a VRF in which the entire address space may be used independently, regardless of the makeup of other VPN address spaces. Hence, it is imperative that a unique RD is assigned to each L3VPN and that the proper RD is configured for each VRF.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2023-03-23

Details

Check Text ( C-57518r844229_chk )
Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM. Review all VRFs configured on CE-facing interfaces and verify that the proper RD has been configured for each. Assuming the assigned RD for "customer 1" is "33:33", verify the route-distinguisher matches. [edit routing-instances] { description "To customer 1"; instance-type vrf; interface .; route-distinguisher 33:33; << Must match the design plan for "customer 1". vrf-target cust1:33:33; << Must match the design plan for "customer 1". vrf-table-label; protocols { ospf { area { interface .; } } } } Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example). If the wrong RD has been configured for any VRF, this is a finding.

Check Text ( C-57518r844229_chk )

Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM.

Review all VRFs configured on CE-facing interfaces and verify that the proper RD has been configured for each. Assuming the assigned RD for "customer 1" is "33:33", verify the route-distinguisher matches.

[edit routing-instances]
{
description "To customer 1";
instance-type vrf;
interface .;
route-distinguisher 33:33; << Must match the design plan for "customer 1".
vrf-target cust1:33:33; << Must match the design plan for "customer 1".
vrf-table-label;
protocols {
ospf {
area {
interface .;
}
}
}
}

Note: In L3 VPN, the CE router forms an adjacency with the PE router (OSPF in the example).

If the wrong RD has been configured for any VRF, this is a finding.

Fix Text (F-57469r844230_fix)
Configure the correct RD for each VRF. set routing-instances description <"appropriate description"> set routing-instances instance-type vrf set routing-instances interface . set routing-instances route-distinguisher 33:33 << Must match the design plan for "customer 1". set routing-instances vrf-target cust1:33:33 << Must match the design plan for "customer 1". set routing-instances vrf-table-label set routing-instances protocols ospf area interface .

Fix Text (F-57469r844230_fix)

Configure the correct RD for each VRF.

set routing-instances description <"appropriate description">
set routing-instances instance-type vrf
set routing-instances interface .
set routing-instances route-distinguisher 33:33 << Must match the design plan for "customer 1".
set routing-instances vrf-target cust1:33:33 << Must match the design plan for "customer 1".
set routing-instances vrf-table-label
set routing-instances protocols ospf area interface .