OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper PE router must be configured to limit the number of MAC addresses it can learn for each Virtual Private LAN Services (VPLS) bridge domain.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-217075JUNI-RT-000700SV-217075r604135_ruleCCI-001094medium
Description
VPLS defines an architecture that delivers Ethernet multipoint services over an MPLS network. Customer Layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet bridging principles. A pseudowire is a virtual bidirectional connection between two attachment circuits (virtual connections between PE and CE routers). A pseudowire contains two unidirectional label-switched paths (LSP). Each MAC forwarding table instance is interconnected using domain-specific LSPs, thereby maintaining privacy and logical separation between each VPLS domain. When a frame arrives on a bridge port (pseudowire or attachment circuit) and the source MAC address is unknown to the receiving PE router, the source MAC address is associated with the pseudowire or attachment circuit and the forwarding table is updated accordingly. Frames are forwarded to the appropriate pseudowire or attachment circuit according to the forwarding table entry for the destination MAC address. Ethernet frames sent to broadcast and unknown destination addresses must be flooded out to all interfaces for the bridge domain; hence, a PE router must replicate packets across both attachment circuits and pseudowires. A malicious attacker residing in a customer network could launch a source MAC address spoofing attack by flooding packets to a valid unicast destination, each with a different MAC source address. The PE router receiving this traffic would try to learn every new MAC address and would quickly run out of space for the VFI forwarding table. Older, valid MAC addresses would be removed from the table, and traffic sent to them would have to be flooded until the storm threshold limit is reached. Hence, it is essential that a limit is established to control the number of MAC addresses that will be learned and recorded into the forwarding table for each bridge domain.
STIGDate
Juniper Router RTR Security Technical Implementation Guide2024-12-05

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (16) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
CM-11(2)Software Installation with Privileged Status
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-18(1)Identify Unacceptable Code and Take Corrective Actions
1.00

+6 more (top 10 by confidence shown)

CCI1 mapping
CCI-001094
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-217075r604135_chk)

Review the PE router configuration to determine if a MAC address limit has been set for each VPLS bridge domain. routing-instances { VPLS_CUST2 { instance-type vpls; interface ge-0/1/0.0; route-distinguisher 22:22; vrf-target target:22:22; protocols { vpls { site-range 9; mac-table-size { nnnn; } no-tunnel-services; site R8 { site-identifier 8; interface ge-0/1/0.0; } vpls-id 102; neighbor 8.8.8.8; } } } } If a limit has not been configured, this is a finding.

Fix Text (F-18302r297094_fix)

Configure a MAC address learning limit for each VPLS bridge domain. [edit routing-instances VPLS_CUST2 protocols vpls] set mac-table-size nnnn