JUNI-RT-000010 - The Juniper router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-101017r2_rule

STIG-ID|JUNI-RT-000010

Vuln-ID|V-90807

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - BGP

800-53|CM-6

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-101019r2_rule

STIG-ID|JUNI-RT-000020

Vuln-ID|V-90809

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - IS-IS key

800-53|SC-8(1)

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - IS-IS type

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - LDP

800-53|AC-4(17)

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - OSPF

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - RIP key

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - RIP type

JUNI-RT-000030 - The Juniper router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-101021r2_rule

STIG-ID|JUNI-RT-000030

Vuln-ID|V-90811

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-101023r1_rule

STIG-ID|JUNI-RT-000040

Vuln-ID|V-90813

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - IS-IS

800-53|IA-3

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - OSPF

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - BGP

Rule-ID|SV-101025r1_rule

STIG-ID|JUNI-RT-000050

Vuln-ID|V-90815

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - IS-IS

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - OSPF

800-53|IA-7

JUNI-RT-000060 - The Juniper router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

CSCv6|3.1

Rule-ID|SV-101027r1_rule

STIG-ID|JUNI-RT-000060

Vuln-ID|V-90817

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - dhcp

800-53|CM-7

CCI|CCI-000381

CSCv6|9.1

Rule-ID|SV-101029r1_rule

STIG-ID|JUNI-RT-000070

Vuln-ID|V-90819

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - finger

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - ftp

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - http

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - telnet

JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - filter

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-101031r1_rule

STIG-ID|JUNI-RT-000120

Vuln-ID|V-90821

JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - policer

800-53|SC-6

JUNI-RT-000130 - The Juniper router must be configured to restrict traffic destined to itself.

800-53|SC-7(12)

CAT|I

CCI|CCI-001097

Rule-ID|SV-101033r2_rule

STIG-ID|JUNI-RT-000130

Vuln-ID|V-90823

JUNI-RT-000140 - The Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-101035r1_rule

STIG-ID|JUNI-RT-000140

Vuln-ID|V-90825

JUNI-RT-000150 - The Juniper router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-101037r1_rule

STIG-ID|JUNI-RT-000150

Vuln-ID|V-90827

JUNI-RT-000170 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-101039r1_rule

STIG-ID|JUNI-RT-000170

Vuln-ID|V-90829

JUNI-RT-000180 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-101041r1_rule

STIG-ID|JUNI-RT-000180

Vuln-ID|V-90831

JUNI-RT-000190 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-101043r1_rule

STIG-ID|JUNI-RT-000190

Vuln-ID|V-90833

JUNI-RT-000200 - The Juniper router must be configured to log all packets that have been dropped - @FILTER_INBOUND_EXTERNAL@

CCI|CCI-000134

Rule-ID|SV-101045r1_rule

STIG-ID|JUNI-RT-000200

Vuln-ID|V-90835

JUNI-RT-000200 - The Juniper router must be configured to log all packets that have been dropped - syslog

800-53|AU-3

JUNI-RT-000210 - The Juniper router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-101047r1_rule

STIG-ID|JUNI-RT-000210

Vuln-ID|V-90837

JUNI-RT-000220 - The Juniper router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-101049r1_rule

STIG-ID|JUNI-RT-000220

Vuln-ID|V-90839

JUNI-RT-000230 - The Juniper router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-101051r1_rule

STIG-ID|JUNI-RT-000230

Vuln-ID|V-90841

JUNI-RT-000240 - The Juniper perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-101053r1_rule

STIG-ID|JUNI-RT-000240

Vuln-ID|V-90843

JUNI-RT-000250 - The Juniper perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-101055r2_rule

STIG-ID|JUNI-RT-000250

Vuln-ID|V-90845

JUNI-RT-000260 - The Juniper perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-101057r2_rule

STIG-ID|JUNI-RT-000260

Vuln-ID|V-90847

JUNI-RT-000270 - The Juniper perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - filter

Rule-ID|SV-101059r2_rule

STIG-ID|JUNI-RT-000270

Vuln-ID|V-90849

JUNI-RT-000270 - The Juniper perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - prefix-list

800-53|SC-7(11)

JUNI-RT-000280 - The Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-101061r1_rule

STIG-ID|JUNI-RT-000280

Vuln-ID|V-90851

JUNI-RT-000290 - The Juniper perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider - BGP peer to an alternate gateway service provider.

Rule-ID|SV-101063r1_rule

STIG-ID|JUNI-RT-000290

Vuln-ID|V-90853

JUNI-RT-000300 - The Juniper perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

800-53|SC-7(20)

Rule-ID|SV-101065r1_rule

STIG-ID|JUNI-RT-000300

Vuln-ID|V-90855

JUNI-RT-000310 - The Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-101067r2_rule

STIG-ID|JUNI-RT-000310

Vuln-ID|V-90857

JUNI-RT-000320 - The Juniper perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

800-53|SC-7

Rule-ID|SV-101069r1_rule

STIG-ID|JUNI-RT-000320

Vuln-ID|V-90859

JUNI-RT-000330 - The Juniper perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-101071r1_rule

STIG-ID|JUNI-RT-000330

Vuln-ID|V-90861

JUNI-RT-000340 - The Juniper perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-101073r1_rule

STIG-ID|JUNI-RT-000340

Vuln-ID|V-90863

JUNI-RT-000350 - The Juniper perimeter router must be configured to block all packets with any IP options.

Rule-ID|SV-101075r2_rule

STIG-ID|JUNI-RT-000350

Vuln-ID|V-90865

JUNI-RT-000360 - The Juniper perimeter router must be configured to have Link Layer Discovery Protocol (LLDP) disabled on all external interfaces - LLDP disabled on all external interfaces.

Rule-ID|SV-101077r1_rule

STIG-ID|JUNI-RT-000360

Vuln-ID|V-90867

JUNI-RT-000370 - The Juniper perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

Rule-ID|SV-101079r1_rule

STIG-ID|JUNI-RT-000370

Vuln-ID|V-90869

JUNI-RT-000380 - The Juniper perimeter router must be configured to block all outbound management traffic.

Rule-ID|SV-101081r1_rule

STIG-ID|JUNI-RT-000380

Vuln-ID|V-90871

JUNI-RT-000390 - The Juniper out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel - IPsec

Rule-ID|SV-101083r1_rule

STIG-ID|JUNI-RT-000390

Vuln-ID|V-90873

JUNI-RT-000390 - The Juniper out-of-band management (OOBM) gateway router must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel - Mgmt

JUNI-RT-000400 - The Juniper out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).

Rule-ID|SV-101085r1_rule

STIG-ID|JUNI-RT-000400

Vuln-ID|V-90875

JUNI-RT-000410 - The Juniper out-of-band management (OOBM) gateway router must be configured to have separate IGP instances for the managed network and management network.

Rule-ID|SV-101087r1_rule

STIG-ID|JUNI-RT-000410

Vuln-ID|V-90877

JUNI-RT-000420 - The Juniper out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

Rule-ID|SV-101089r1_rule

STIG-ID|JUNI-RT-000420

Vuln-ID|V-90879

JUNI-RT-000430 - The Juniper out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.

Detections

Analytics

DISA STIG Juniper Router RTR v1r4

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Mar 18, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 1, 2021 Miscellaneous Metadata updated. References updated.