JUSX-AG-000019 - For User Role Firewalls, the Juniper SRX Services Gateway Firewall must employ user attribute-based security policies to enforce approved authorizations for logical access to information and system resources.

800-53|AC-3

CAT|II

CCI|CCI-000213

Rule-ID|SV-214518r557389_rule

STIG-ID|JUSX-AG-000019

STIG-Legacy|SV-80493

STIG-Legacy|V-66003

Vuln-ID|V-214518

JUSX-AG-000036 - The Juniper SRX Services Gateway must generate log records when firewall filters, security screens and security policies are invoked and the traffic is denied or restricted.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-214519r557389_rule

STIG-ID|JUSX-AG-000036

STIG-Legacy|SV-80793

STIG-Legacy|V-66303

Vuln-ID|V-214519

JUSX-AG-000037 - The Juniper SRX Services Gateway Firewall must generate audit records when unsuccessful attempts to access security zones occur.

Rule-ID|SV-214520r557389_rule

STIG-ID|JUSX-AG-000037

STIG-Legacy|SV-80795

STIG-Legacy|V-66305

Vuln-ID|V-214520

JUSX-AG-000057 - The Juniper SRX Services Gateway Firewall must be configured to support centralized management and configuration of the audit log.

800-53|AU-3(2)

CCI|CCI-001844

Rule-ID|SV-214521r557389_rule

STIG-ID|JUSX-AG-000057

STIG-Legacy|SV-80797

STIG-Legacy|V-66307

Vuln-ID|V-214521

JUSX-AG-000063 - In the event that communications with the Syslog server is lost, the Juniper SRX Services Gateway must continue to queue traffic log records locally.

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-214522r557389_rule

STIG-ID|JUSX-AG-000063

STIG-Legacy|SV-80799

STIG-Legacy|V-66309

Vuln-ID|V-214522

JUSX-AG-000083 - The Juniper SRX Services Gateway Firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-214523r557389_rule

STIG-ID|JUSX-AG-000083

STIG-Legacy|SV-80801

STIG-Legacy|V-66311

Vuln-ID|V-214523

JUSX-AG-000084 - The Juniper SRX Services Gateway Firewall must not be configured as an NTP server since providing this network service is unrelated to the role as a firewall.

Rule-ID|SV-214524r557389_rule

STIG-ID|JUSX-AG-000084

STIG-Legacy|SV-80803

STIG-Legacy|V-66313

Vuln-ID|V-214524

JUSX-AG-000085 - The Juniper SRX Services Gateway Firewall must not be configured as a DNS proxy since providing this network service is unrelated to the role as a Firewall.

Rule-ID|SV-214525r557389_rule

STIG-ID|JUSX-AG-000085

STIG-Legacy|SV-80805

STIG-Legacy|V-66315

Vuln-ID|V-214525

JUSX-AG-000086 - The Juniper SRX Services Gateway Firewall must not be configured as a DHCP server since providing this network service is unrelated to the role as a Firewall.

Rule-ID|SV-214526r557389_rule

STIG-ID|JUSX-AG-000086

STIG-Legacy|SV-80807

STIG-Legacy|V-66317

Vuln-ID|V-214526

JUSX-AG-000087 - The Juniper SRX Services Gateway Firewall must be configured to prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services, as defined in the PPSM CAL, vulnerability assessments.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-214527r557389_rule

STIG-ID|JUSX-AG-000087

STIG-Legacy|SV-80809

STIG-Legacy|V-66319

Vuln-ID|V-214527

JUSX-AG-000105 - The Juniper SRX Services Gateway Firewall must terminate all communications sessions associated with user traffic after 15 minutes or less of inactivity.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-214528r557389_rule

STIG-ID|JUSX-AG-000105

STIG-Legacy|SV-80811

STIG-Legacy|V-66321

Vuln-ID|V-214528

JUSX-AG-000120 - The Juniper SRX Services Gateway Firewall providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by implementing statistics-based screens.

800-53|SC-5

CAT|I

CCI|CCI-002385

Rule-ID|SV-214529r559708_rule

STIG-ID|JUSX-AG-000120

STIG-Legacy|SV-80813

STIG-Legacy|V-66323

Vuln-ID|V-214529

JUSX-AG-000121 - The Juniper SRX Services Gateway Firewall must implement load balancing on the perimeter firewall, at a minimum, to limit the effects of known and unknown types of Denial of Service (DoS) attacks on the network.

Rule-ID|SV-214530r557389_rule

STIG-ID|JUSX-AG-000121

STIG-Legacy|SV-80815

STIG-Legacy|V-66325

Vuln-ID|V-214530

JUSX-AG-000122 - The Juniper SRX Services Gateway Firewall must protect against known types of Denial of Service (DoS) attacks by implementing signature-based screens.

Rule-ID|SV-214531r557389_rule

STIG-ID|JUSX-AG-000122

STIG-Legacy|SV-80817

STIG-Legacy|V-66327

Vuln-ID|V-214531

JUSX-AG-000124 - The Juniper SRX Services Gateway Firewall must block outbound traffic containing known and unknown DoS attacks to protect against the use of internal information systems to launch any Denial of Service (DoS) attacks against other networks or endpoints.

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-214532r557389_rule

STIG-ID|JUSX-AG-000124

STIG-Legacy|SV-80819

STIG-Legacy|V-66329

Vuln-ID|V-214532

JUSX-AG-000126 - The Juniper SRX Services Gateway Firewall must only allow inbound communications from organization-defined authorized sources routed to organization-defined authorized destinations.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-214533r557389_rule

STIG-ID|JUSX-AG-000126

STIG-Legacy|SV-80821

STIG-Legacy|V-66331

Vuln-ID|V-214533

JUSX-AG-000127 - The Juniper SRX Services Gateway Firewall must be configured to fail securely in the event of an operational failure of the firewall filtering or boundary protection function.

800-53|SC-7(18)

CCI|CCI-001126

Rule-ID|SV-214534r557389_rule

STIG-ID|JUSX-AG-000127

STIG-Legacy|SV-80823

STIG-Legacy|V-66333

Vuln-ID|V-214534

JUSX-AG-000128 - The Juniper SRX Services Gateway Firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-214535r557389_rule

STIG-ID|JUSX-AG-000128

STIG-Legacy|SV-80825

STIG-Legacy|V-66335

Vuln-ID|V-214535

JUSX-AG-000132 - The Juniper SRX Services Gateway Firewall must configure ICMP to meet DoD requirements.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-214536r557389_rule

STIG-ID|JUSX-AG-000132

STIG-Legacy|SV-80827

STIG-Legacy|V-66337

Vuln-ID|V-214536

JUSX-AG-000144 - The Juniper SRX Services Gateway Firewall must continuously monitor all inbound communications traffic for unusual/unauthorized activities or conditions.

800-53|SI-4(4)

CCI|CCI-002661

Rule-ID|SV-214537r557389_rule

STIG-ID|JUSX-AG-000144

STIG-Legacy|SV-80829

STIG-Legacy|V-66339

Vuln-ID|V-214537

JUSX-AG-000145 - The Juniper SRX Services Gateway Firewall must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002662

Rule-ID|SV-214538r557389_rule

STIG-ID|JUSX-AG-000145

STIG-Legacy|SV-80831

STIG-Legacy|V-66341

Vuln-ID|V-214538

JUSX-AG-000146 - The Juniper SRX Services Gateway Firewall must generate an alert to, at a minimum, the ISSO and ISSM when unusual/unauthorized activities or conditions are detected during continuous monitoring of communications traffic as it traverses inbound or outbound  across internal security boundaries.

800-53|SI-4(5)

CCI|CCI-002664

Rule-ID|SV-214539r557389_rule

STIG-ID|JUSX-AG-000146

STIG-Legacy|SV-80833

STIG-Legacy|V-66343

Vuln-ID|V-214539

JUSX-AG-000147 - The Juniper SRX Services Gateway Firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources are detected.

Rule-ID|SV-214540r557389_rule

STIG-ID|JUSX-AG-000147

STIG-Legacy|SV-80835

STIG-Legacy|V-66345

Vuln-ID|V-214540

JUSX-AG-000150 - The Juniper SRX Services Gateway Firewall must generate an alert that can be forwarded to, at a minimum, the ISSO and ISSM when DoS incidents are detected.

Detections

Analytics

DISA Juniper SRX Services Gateway ALG v2r1

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous