This requirement is not applicable for the DODIN Backbone. Review the router configuration to verify that stateless firewall filters are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols. Verify the IP addresses are appropriate for the target environment. IP addresses are configured in lists at [edit policy-options] or are directly embedded into each term. [edit policy-options] prefix-list inside-addresses-ipv4 { <inside IPv4 subnet>/<mask>; <inside IPv4 subnet>/<mask>; } prefix-list inside-addresses-ipv6 { <inside IPv6 subnet>/<prefix>; <inside IPv6 subnet>/<prefix>; } For example: [edit firewall] family inet { filter authorized-outbound-ipv4 { term permitted-http { from { source-prefix-list { inside-addresses-ipv4; } destination-address { <destination IPv4 address>/<mask>; } protocol tcp; destination-port http; } then accept; } : <other terms> : term permitted-source-addresses { from { source-prefix-list { inside-addresses-ipv4; } protocol-except tcp; destination-port-except http; } then accept; } term default-deny { then { log; syslog; discard; } } } } family inet6 { filter authorized-outbound-ipv6 { term permitted-http { from { source-prefix-list { inside-addresses-ipv6; } destination-address { <destination IPv6 address>/<prefix>; } next-header tcp; destination-port http; } then accept; } : <other terms> : term permitted-source-addresses { from { source-prefix-list { inside-addresses-ipv6; } next-header-except tcp; destination-port-except http; } then accept; } term default-deny { then { log; syslog; discard; } } } } Verify filters are applied to the correct interface. For example, the "authorized-outbound" filter, as written, should be applied to the ingress of internal interfaces: [edit interfaces] <internal interface name> { unit <number> { family inet { filter { input authorized-outbound-ipv4; } address <IPv4 address>/<mask>; } family inet6 { filter { input authorized-outbound-ipv6; } address <IPv6 address>/<prefix>; } } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" and "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.