The Juniper EX switch must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253944 | JUEX-NM-000670 | SV-253944r1028872_rule | CCI-002605 | high |
| Description | ||||
| The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. Information stored in one location is vulnerable to accidental or incidental deletion or alteration. | ||||
| STIG | Date | |||
| Juniper EX Series Switches Network Device Management Security Technical Implementation Guide | 2025-03-07 | |||
Related Frameworks
5 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
SI-2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1713 mappings
3.14.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.3
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-002605
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-253944r1028872_chk)
1. Verify that the network device is configured to send log data to a redundant central log servers.
2. Verify the external syslog server is configured. The lowest severity level, "any", is debug and will generate a significant number of messages.
[edit system syslog]
host <external syslog address> {
any info;
structured-format; << Only if structured formatting is required, otherwise events are recorded in standard format.
}
time-format year;
If the network device is not configured to send log data to redundant log servers, this is a finding.
Fix Text (F-57347r1018703_fix)
Add the following stanzas to the configuration.
set system syslog host <external syslog host1 IPv4 or IPv6 address> any info
set system syslog host <external syslog host2 IPv4 or IPv6 address> any info
Note: The time-format command supports including the year and/or the time in milliseconds. The default format does not include the year and time is recorded in seconds.