The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-254036 | JUEX-RT-000640 | SV-254036r844141_rule | CCI-002385 | medium |
| Description | ||||
| The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis. | ||||
| STIG | Date | |||
| Juniper EX Series Switches Router Security Technical Implementation Guide | 2024-06-10 | |||
Details
Check Text (C-254036r844141_chk)
Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP Redirect messages out to any external interfaces.
Verify the global "no-redirects" statement is enabled under [edit system] or that individual interface "no-redirects" statements are configured on external interfaces.
[edit system]
no-redirects;
[edit interfaces]
<external interface name> {
unit <number> {
family inet {
no-redirects;
address <IPv4 address>.<mask>;
}
family inet6 {
no-redirects;
address <IPv6 address>.<prefix>;
}
}
}
If ICMP Redirect messages are enabled on any external interfaces, this is a finding.
Fix Text (F-57439r844140_fix)
Disable ICMP redirects on all external interfaces.
set system no-redirects
set interfaces <external interface name> unit <number> family inet no-redirects
set interfaces <external interface name> unit <number> family inet6 no-redirects