OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper EX switch must not use the default VLAN for management traffic.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253969JUEX-L2-000220SV-253969r997519_ruleCCI-004891medium
Description
By default, all unassigned interfaces are placed into the default VLAN and if used for management, could unintentionally expose sensitive traffic or protected resources to unauthorized devices.
STIGDate
Juniper EX Series Switches Layer 2 Switch Security Technical Implementation Guide2025-12-10

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CLD-03Cloud Infrastructure Security Subnet
0.50
NET-03.8Separate Subnet for Connecting to Different Security Domains
0.50
NET-06.1Security Management Subnets
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
SC-47Alternate Communications Paths
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-8Transmission Confidentiality and Integrity
1.00
CCI1 mapping
CCI-004891
1.00

Details

Check Text (C-253969r997519_chk)

Review the switch configuration and verify that the default VLAN is not used to access the switch for management. Verify access interfaces used for management are assigned to an appropriate VLAN as in the example below. [edit interfaces] <interface name> { unit 0 { family ethernet-switching { interface-mode access; vlan { members <vlan name>; } } } } If the default VLAN is being used to access the switch, this is a finding.

Fix Text (F-57372r843939_fix)

Configure the switch for management access to use a VLAN other than the default VLAN. set interfaces <interface name> unit 0 family ethernet-switching interface-mode access set interfaces <interface name> unit 0 family ethernet-switching vlan members <vlan name>