JUEX-L2-000010 - The Juniper EX switch must be configured to disable non-essential capabilities.

800-53|CM-7a.

CAT|I

CCI|CCI-000381

Rule-ID|SV-253948r843877_rule

STIG-ID|JUEX-L2-000010

Vuln-ID|V-253948

JUEX-L2-000020 - The Juniper EX switch must be configured to uniquely identify all network-connected endpoint devices before establishing any connection.

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-253949r843880_rule

STIG-ID|JUEX-L2-000020

Vuln-ID|V-253949

JUEX-L2-000030 - The Juniper layer 2 switch must be configured to disable all dynamic VLAN registration protocols.

800-53|IA-7

CAT|II

CCI|CCI-000803

Rule-ID|SV-253950r843883_rule

STIG-ID|JUEX-L2-000030

Vuln-ID|V-253950

JUEX-L2-000040 - The Juniper EX switch must be configured to manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-253951r843886_rule

STIG-ID|JUEX-L2-000040

Vuln-ID|V-253951

JUEX-L2-000050 - The Juniper EX switch must be configured to permit authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-253952r843889_rule

STIG-ID|JUEX-L2-000050

Vuln-ID|V-253952

JUEX-L2-000060 - The Juniper EX switch must be configured to permit authorized users to remotely view, in real time, all content related to an established user session from a component separate from the layer 2 switch.

800-53|AU-14(3)

CCI|CCI-001920

Rule-ID|SV-253953r843892_rule

STIG-ID|JUEX-L2-000060

Vuln-ID|V-253953

JUEX-L2-000070 - The Juniper EX switch must be configured to authenticate all network-connected endpoint devices before establishing any connection.

CCI|CCI-001958

Rule-ID|SV-253954r843895_rule

STIG-ID|JUEX-L2-000070

Vuln-ID|V-253954

JUEX-L2-000080 - The Juniper EX switch must be configured to enable Root Protection on all interfaces connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-253955r843898_rule

STIG-ID|JUEX-L2-000080

Vuln-ID|V-253955

JUEX-L2-000090 - The Juniper EX switch must be configured to enable BPDU Protection on all user-facing or untrusted access switch ports.

Rule-ID|SV-253956r843901_rule

STIG-ID|JUEX-L2-000090

Vuln-ID|V-253956

JUEX-L2-000100 - The Juniper EX switch must be configured to enable STP Loop Protection on all non-designated STP switch ports.

Rule-ID|SV-253957r843904_rule

STIG-ID|JUEX-L2-000100

Vuln-ID|V-253957

JUEX-L2-000110 - The Juniper EX switch must be configured not to forward unknown unicast traffic to access interfaces.

Rule-ID|SV-253958r843907_rule

STIG-ID|JUEX-L2-000110

Vuln-ID|V-253958

JUEX-L2-000120 - The Juniper EX switch must be configured to enable DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

Rule-ID|SV-253959r843910_rule

STIG-ID|JUEX-L2-000120

Vuln-ID|V-253959

JUEX-L2-000130 - The Juniper EX switch must be configured to enable IP Source Guard on all user-facing or untrusted access VLANs.

Rule-ID|SV-253960r843913_rule

STIG-ID|JUEX-L2-000130

Vuln-ID|V-253960

JUEX-L2-000140 - The Juniper EX switch must be configured to enable Dynamic Address Resolution Protocol (ARP) Inspection (DAI) on all user VLANs.

Rule-ID|SV-253961r843916_rule

STIG-ID|JUEX-L2-000140

Vuln-ID|V-253961

JUEX-L2-000150 - The Juniper EX switch must be configured to enable Storm Control on all host-facing access interfaces.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-253962r843919_rule

STIG-ID|JUEX-L2-000150

Vuln-ID|V-253962

JUEX-L2-000160 - The Juniper EX switch must be configured to enable IGMP or MLD Snooping on all VLANs.

Rule-ID|SV-253963r843922_rule

STIG-ID|JUEX-L2-000160

Vuln-ID|V-253963

JUEX-L2-000170 - If STP is used, the Juniper EX switch must be configured to implement Rapid STP, or Multiple STP, where VLANs span multiple switches with redundant links.

Rule-ID|SV-253964r843925_rule

STIG-ID|JUEX-L2-000170

Vuln-ID|V-253964

JUEX-L2-000180 - The Juniper EX switch must be configured to verify two-way connectivity on all interswitch trunked interfaces.

Rule-ID|SV-253965r843928_rule

STIG-ID|JUEX-L2-000180

Vuln-ID|V-253965

JUEX-L2-000190 - The Juniper EX switch must be configured to assign all disabled access interfaces to an unused VLAN.

Rule-ID|SV-253966r843931_rule

STIG-ID|JUEX-L2-000190

Vuln-ID|V-253966

JUEX-L2-000200 - The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.

Rule-ID|SV-253967r843934_rule

STIG-ID|JUEX-L2-000200

Vuln-ID|V-253967

JUEX-L2-000210 - The Juniper EX switch must be configured to prune the default VLAN from all trunked interfaces that do not require it.

Rule-ID|SV-253968r843937_rule

STIG-ID|JUEX-L2-000210

Vuln-ID|V-253968

JUEX-L2-000220 - The Juniper EX switch must not use the default VLAN for management traffic.

Rule-ID|SV-253969r843940_rule

STIG-ID|JUEX-L2-000220

Vuln-ID|V-253969

JUEX-L2-000230 - The Juniper EX switch must be configured to set all user-facing or untrusted ports as access interfaces.

Rule-ID|SV-253970r843943_rule

STIG-ID|JUEX-L2-000230

Vuln-ID|V-253970

JUEX-L2-000240 - The Juniper EX switch must not have a native VLAN ID assigned, or have a unique native VLAN ID, for all 802.1q trunk links.

Rule-ID|SV-253971r843946_rule

STIG-ID|JUEX-L2-000240

Vuln-ID|V-253971

JUEX-L2-000250 - The Juniper EX switch must not have any access interfaces assigned to a VLAN configured as native for any trunked interface.

Detections

Analytics

DISA Juniper EX Series Layer 2 Switch v1r2

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.1 May 3, 2024 Miscellaneous Metadata updated. See also link updated.

Detections

Analytics

DISA Juniper EX Series Layer 2 Switch v1r2 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Juniper EX Series Layer 2 Switch v1r2