The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-217024 | JUNI-RT-000190 | SV-217024r855892_rule | CCI-002385 | medium |
| Description | ||||
| The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis. | ||||
| STIG | Date | |||
| Juniper Router RTR Security Technical Implementation Guide | 2024-12-05 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
SC-5
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-002385
1.00
- DISA · V3R2 · disa_xccdf · related
Details
Check Text (C-217024r855892_chk)
Review the device configuration to determine if it has been configured to ensure the router does not send ICMP Redirect messages out to any external interface.
interfaces {
ge-1/0/0 {
unit 0 {
family inet {
no-redirects;
address 11.1.12.2/24;
}
}
}
ge-1/1/0 {
unit 0 {
family inet {
no-redirects;
address 11.1.23.2/24;
}
}
}
If ICMP Redirect messages are enabled on any external interfaces, this is a finding.
Fix Text (F-18251r296941_fix)
Disable ICMP redirects on all external interfaces as shown in the example below.
[edit interfaces]
set ge-1/0/0 unit 0 family inet no-redirects
set ge-1/1/0 unit 0 family inet no-redirects