JUEX-NM-000010 - The Juniper EX switch must be configured to limit the number of concurrent management sessions to 10 or less.

CAT|II

CCI|CCI-000054

Rule-ID|SV-253878r960735_rule

STIG-ID|JUEX-NM-000010

Vuln-ID|V-253878

JUEX-NM-000020 - The Juniper EX switch must be configured to automatically audit account creation.

CCI|CCI-000018

Rule-ID|SV-253879r960777_rule

STIG-ID|JUEX-NM-000020

Vuln-ID|V-253879

JUEX-NM-000060 - The Juniper EX switch must be configured to assign appropriate user roles or access levels to authenticated users.

CAT|I

CCI|CCI-000213

Rule-ID|SV-253883r960792_rule

STIG-ID|JUEX-NM-000060

Vuln-ID|V-253883

JUEX-NM-000070 - The Juniper EX switch must be configured to enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.

CCI|CCI-001368

CCI|CCI-004192

Rule-ID|SV-253884r997739_rule

STIG-ID|JUEX-NM-000070

Vuln-ID|V-253884

JUEX-NM-000080 - The Juniper EX switch must be configured to enforce the limit of three consecutive invalid logon attempts for any given user, after which time it must block any login attempt for that user for 15 minutes.

CCI|CCI-000044

Rule-ID|SV-253885r960840_rule

STIG-ID|JUEX-NM-000080

Vuln-ID|V-253885

JUEX-NM-000090 - The Juniper EX switch must be configured to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device.

CCI|CCI-000048

Rule-ID|SV-253886r960843_rule

STIG-ID|JUEX-NM-000090

Vuln-ID|V-253886

JUEX-NM-000120 - The Juniper device must be configured to produce audit log records containing sufficient information to establish what type of event occurred.

CCI|CCI-000130

Rule-ID|SV-253889r960891_rule

STIG-ID|JUEX-NM-000120

Vuln-ID|V-253889

JUEX-NM-000130 - The Juniper EX switch must be configured to produce audit records containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-253890r960894_rule

STIG-ID|JUEX-NM-000130

Vuln-ID|V-253890

JUEX-NM-000140 - The Juniper EX switch must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-253891r960897_rule

STIG-ID|JUEX-NM-000140

Vuln-ID|V-253891

JUEX-NM-000150 - The Juniper EX switch must be configured to produce audit log records containing information to establish the source of events.

CCI|CCI-000133

Rule-ID|SV-253892r960900_rule

STIG-ID|JUEX-NM-000150

Vuln-ID|V-253892

JUEX-NM-000160 - The Juniper EX switch must be configured to produce audit records that contain information to establish the outcome of the event.

CCI|CCI-000134

Rule-ID|SV-253893r960903_rule

STIG-ID|JUEX-NM-000160

Vuln-ID|V-253893

JUEX-NM-000170 - The Juniper EX switch must be configured to generate audit records containing information that establishes the identity of any individual or process associated with the event.

CCI|CCI-001487

Rule-ID|SV-253894r960906_rule

STIG-ID|JUEX-NM-000170

Vuln-ID|V-253894

JUEX-NM-000190 - The Juniper EX switch must be configured to protect audit information from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-253896r960933_rule

STIG-ID|JUEX-NM-000190

Vuln-ID|V-253896

JUEX-NM-000200 - The Juniper EX switch must be configured to protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-253897r960936_rule

STIG-ID|JUEX-NM-000200

Vuln-ID|V-253897

JUEX-NM-000210 - The Juniper EX switch must be configured to protect audit tools from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-253898r960939_rule

STIG-ID|JUEX-NM-000210

Vuln-ID|V-253898

JUEX-NM-000220 - The Juniper EX switch must be configured to limit privileges to change the software resident within software libraries.

CCI|CCI-001499

Rule-ID|SV-253899r960960_rule

STIG-ID|JUEX-NM-000220

Vuln-ID|V-253899

JUEX-NM-000230 - The Juniper EX switch must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

CCI|CCI-000382

Rule-ID|SV-253900r960966_rule

STIG-ID|JUEX-NM-000230

Vuln-ID|V-253900

JUEX-NM-000240 - The Juniper EX switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-253901r960969_rule

STIG-ID|JUEX-NM-000240

Vuln-ID|V-253901

JUEX-NM-000260 - The Juniper EX switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

CCI|CCI-001941

Rule-ID|SV-253903r960993_rule

STIG-ID|JUEX-NM-000260

Vuln-ID|V-253903

JUEX-NM-000270 - The Juniper EX switch must be configured to enforce a minimum 15-character password length.

CCI|CCI-004066

Rule-ID|SV-253904r997740_rule

STIG-ID|JUEX-NM-000270

Vuln-ID|V-253904

JUEX-NM-000280 - The Juniper EX switch must be configured to enforce password complexity by requiring that at least one uppercase character be used.

Rule-ID|SV-253905r997741_rule

STIG-ID|JUEX-NM-000280

Vuln-ID|V-253905

JUEX-NM-000290 - The Juniper EX switch must be configured to enforce password complexity by requiring that at least one lowercase character be used.

Rule-ID|SV-253906r997742_rule

STIG-ID|JUEX-NM-000290

Vuln-ID|V-253906

JUEX-NM-000300 - The Juniper EX switch must be configured to enforce password complexity by requiring that at least one numeric character be used.

Rule-ID|SV-253907r997743_rule

STIG-ID|JUEX-NM-000300

Vuln-ID|V-253907

JUEX-NM-000310 - The Juniper EX switch must be configured to enforce password complexity by requiring that at least one punctuation (special) character be used.

Rule-ID|SV-253908r997744_rule

STIG-ID|JUEX-NM-000310

Vuln-ID|V-253908

JUEX-NM-000320 - The Juniper EX switch must be configured to require that when a password is changed, the characters are changed in at least eight of the positions within the password.

Rule-ID|SV-253909r997745_rule

STIG-ID|JUEX-NM-000320

Vuln-ID|V-253909

JUEX-NM-000330 - The Juniper EX switch must be configured to only store cryptographic representations of passwords.

CCI|CCI-004062

Rule-ID|SV-253910r997746_rule

STIG-ID|JUEX-NM-000330

Vuln-ID|V-253910

JUEX-NM-000340 - The Juniper EX switch must be configured to use FIPS 140-2 approved algorithms for authentication to a cryptographic module.

CCI|CCI-000803

Rule-ID|SV-253911r961050_rule

STIG-ID|JUEX-NM-000340

Vuln-ID|V-253911

JUEX-NM-000360 - The Juniper EX switch must be configured to end all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill mission requirements.

CCI|CCI-001133

Rule-ID|SV-253913r961068_rule

STIG-ID|JUEX-NM-000360

Vuln-ID|V-253913

JUEX-NM-000370 - The Juniper device must be configured to only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).

CCI|CCI-001199

Rule-ID|SV-253914r961128_rule

STIG-ID|JUEX-NM-000370

Vuln-ID|V-253914

JUEX-NM-000390 - The Juniper EX switch must be configured to enforce organization-defined role-based access control policies over defined subjects and objects.

CCI|CCI-000366

CCI|CCI-002169

Rule-ID|SV-253916r987662_rule

STIG-ID|JUEX-NM-000390

Vuln-ID|V-253916

JUEX-NM-000410 - The Juniper EX switch must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-253918r961392_rule

STIG-ID|JUEX-NM-000410

Vuln-ID|V-253918

JUEX-NM-000420 - The Juniper EX switch must be configured to generate an immediate real-time alert of all audit failure events requiring real-time alerts.

CCI|CCI-001858

Rule-ID|SV-253919r961401_rule

STIG-ID|JUEX-NM-000420

Vuln-ID|V-253919

JUEX-NM-000430 - The Juniper EX switch must be configured to synchronize internal information system clocks using redundant authoritative time sources.

CCI|CCI-004922

CCI|CCI-004923

CCI|CCI-004928

Rule-ID|SV-253920r997748_rule

STIG-ID|JUEX-NM-000430

Vuln-ID|V-253920

JUEX-NM-000440 - The Juniper EX switch must be configured to record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-253921r961443_rule

STIG-ID|JUEX-NM-000440

Vuln-ID|V-253921

JUEX-NM-000450 - The Juniper EX switch must be configured to prohibit installation of software without explicit privileged status.

CCI|CCI-003980

Rule-ID|SV-253922r997750_rule

STIG-ID|JUEX-NM-000450

Vuln-ID|V-253922

JUEX-NM-000460 - The Juniper EX switch must be configured to enforce access restrictions associated with changes to device configuration.

CCI|CCI-001813

Rule-ID|SV-253923r961461_rule

STIG-ID|JUEX-NM-000460

Vuln-ID|V-253923

JUEX-NM-000480 - The Juniper EX switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

CCI|CCI-001967

Rule-ID|SV-253925r961506_rule

STIG-ID|JUEX-NM-000480

Vuln-ID|V-253925

JUEX-NM-000490 - The Juniper EX switch must use an an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server.

CAT|III

Rule-ID|SV-253926r961506_rule

STIG-ID|JUEX-NM-000490

Vuln-ID|V-253926

JUEX-NM-000500 - The Juniper EX switch must be configured to prohibit the use of cached authenticators after an organization-defined time period.

CCI|CCI-002007

Rule-ID|SV-253927r961521_rule

STIG-ID|JUEX-NM-000500

Vuln-ID|V-253927

JUEX-NM-000510 - The Juniper EX switches must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.

CCI|CCI-002890

Rule-ID|SV-253928r961554_rule

STIG-ID|JUEX-NM-000510

Detections

Analytics

DISA Juniper EX Series Network Device Management v2r1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous