OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper SRX Services Gateway must implement service redundancy to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-223235JUSX-DM-000164SV-223235r961620_ruleCCI-002385low
Description
Service redundancy, may reduce the susceptibility to some DoS attacks. Organizations must consider the need for service redundancy in accordance with DoD policy. If service redundancy is required then this technical control is applicable. The Juniper SRX can configure your system to monitor the health of the interfaces belonging to a redundancy group.
STIGDate
Juniper SRX Services Gateway NDM Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01Continuous Monitoring
1.00
MON-01.1Intrusion Detection & Prevention Systems (IDS & IPS)
1.00
MON-01.3Inbound & Outbound Communications Traffic
1.00
MON-01.4System Generated Alerts
1.00
MON-01.8Security Event Monitoring
1.00
NET-01Network Security Controls (NSC)
1.00
NET-02Layered Network Defenses
1.00
SEA-01Secure Engineering Principles
1.00
SEA-02Alignment With Enterprise Architecture
1.00
CAP-01Capacity & Performance Management
0.50

+3 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (36) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-5Response to Audit Logging Process Failures
1.00
CM-11(2)Software Installation with Privileged Status
1.00

+26 more (top 10 by confidence shown)

CCI1 mapping
CCI-002385
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.IR-01
1.00
PR.IR-04
0.50

Who does this work

12 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-223235r961620_chk)

If service redundancy is not required by the organization's policy, this is not a finding. Verify the configuration is working properly: [edit] show chassis cluster interfaces command. If service redundancy is not configured, this is a finding.

Fix Text (F-24896r513393_fix)

Interfaces can be monitored by a redundancy group for automatic failover to another node. Assign a weight to the interface to be monitored. This configuration is an extremely complex configuration. Consult the vendor documentation. Set the chassis cluster node ID and cluster ID. Configure the chassis cluster management interface. Configure the chassis cluster fabric. Configure the chassis cluster redundancy group Specify the interface to be monitored by a redundancy group. Specify the interface to be monitored by a redundancy group. Example: [edit] set chassis cluster redundancy-group 1 interface-monitor ge-6/0/2 weight 255