OpenControls Logo

STIG Viewer

STIGViewer Support

For nonlocal maintenance sessions, the Juniper SRX Services Gateway must ensure only zones where management functionality is desired have host-inbound-traffic system-services configured.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-223228JUSX-DM-000152SV-223228r961557_ruleCCI-003123medium
Description
Add a firewall filter to protect the management interface. Note: The dedicated management interface (if present), and an interface placed in the functional zone management, will not participate in routing network traffic. It will only support device management traffic. The host-inbound-traffic feature of the SRX is an additional layer of security for system services. This function can be configured on either a per zone or a per interface basis within each individual security zone. By default, a security zone has all system services disabled, which means that it will not accept any inbound management or protocol requests on the control plane without explicitly enabling the service at either the interface or zone in the security zone stanzas.
STIGDate
Juniper SRX Services Gateway NDM Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (26) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+16 more (top 10 by confidence shown)

CCI1 mapping
CCI-003123
1.00

Details

Check Text (C-223228r961557_chk)

Verify only those zones where management functionality is allowed have host-inbound-traffic system-services configured and that protocols such as HTTP and HTTPS are not assigned to these zones. [edit] show security zones functional-zone management If zones configured for host-inbound-traffic system-services have protocols other than SSH configured, this is a finding.

Fix Text (F-24889r513372_fix)

Remove host-inbound-traffic systems-services option from zones not authorized for management traffic. Remove unauthorized protocols (e.g., HTTP, HTTPS) from management zones that are configured to allow host-inbound-traffic system-services.