JUNI-RT-000010 - The Juniper router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

CAT|II

CCI|CCI-001368

Rule-ID|SV-217011r604135_rule

STIG-ID|JUNI-RT-000010

STIG-Legacy|SV-101017

STIG-Legacy|V-90807

Vuln-ID|V-217011

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - BGP

CCI|CCI-000366

CCI|CCI-002205

Rule-ID|SV-217012r604135_rule

STIG-ID|JUNI-RT-000020

STIG-Legacy|SV-101019

STIG-Legacy|V-90809

Vuln-ID|V-217012

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - IS-IS key

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - IS-IS type

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - LDP

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - OSPF

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - RIP key

JUNI-RT-000020 - The Juniper router must be configured to implement message authentication for all control plane protocols - RIP type

JUNI-RT-000030 - The Juniper router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

Rule-ID|SV-217013r604135_rule

STIG-ID|JUNI-RT-000030

STIG-Legacy|SV-101021

STIG-Legacy|V-90811

Vuln-ID|V-217013

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - BGP

CCI|CCI-000803

Rule-ID|SV-217014r604135_rule

STIG-ID|JUNI-RT-000040

STIG-Legacy|SV-101023

STIG-Legacy|V-90813

Vuln-ID|V-217014

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - IS-IS

JUNI-RT-000040 - The Juniper router must be configured to use encryption for routing protocol authentication - OSPF

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - BGP

Rule-ID|SV-217015r604135_rule

STIG-ID|JUNI-RT-000050

STIG-Legacy|SV-101025

STIG-Legacy|V-90815

Vuln-ID|V-217015

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - IS-IS

JUNI-RT-000050 - The Juniper router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 140-2 message authentication code algorithm - OSPF

JUNI-RT-000060 - The Juniper router must be configured to have all inactive interfaces disabled.

CAT|III

CCI|CCI-001414

Rule-ID|SV-217016r604135_rule

STIG-ID|JUNI-RT-000060

STIG-Legacy|SV-101027

STIG-Legacy|V-90817

Vuln-ID|V-217016

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - dhcp

CCI|CCI-000381

Rule-ID|SV-217017r604135_rule

STIG-ID|JUNI-RT-000070

STIG-Legacy|SV-101029

STIG-Legacy|V-90819

Vuln-ID|V-217017

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - finger

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - ftp

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - http

JUNI-RT-000070 - The Juniper router must be configured to have all non-essential capabilities disabled - telnet

JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - filter

CCI|CCI-002385

Rule-ID|SV-217018r604135_rule

STIG-ID|JUNI-RT-000120

STIG-Legacy|SV-101031

STIG-Legacy|V-90821

Vuln-ID|V-217018

JUNI-RT-000120 - The Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection - policer

JUNI-RT-000130 - The Juniper router must be configured to restrict traffic destined to itself.

CAT|I

CCI|CCI-001097

Rule-ID|SV-217019r604135_rule

STIG-ID|JUNI-RT-000130

STIG-Legacy|SV-101033

STIG-Legacy|V-90823

Vuln-ID|V-217019

JUNI-RT-000140 - The Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-217020r604135_rule

STIG-ID|JUNI-RT-000140

STIG-Legacy|SV-101035

STIG-Legacy|V-90825

Vuln-ID|V-217020

JUNI-RT-000150 - The Juniper router must be configured to have Gratuitous ARP disabled on all external interfaces.

Rule-ID|SV-217021r604135_rule

STIG-ID|JUNI-RT-000150

STIG-Legacy|SV-101037

STIG-Legacy|V-90827

Vuln-ID|V-217021

JUNI-RT-000170 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.

Rule-ID|SV-217022r604135_rule

STIG-ID|JUNI-RT-000170

STIG-Legacy|SV-101039

STIG-Legacy|V-90829

Vuln-ID|V-217022

JUNI-RT-000180 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.

Rule-ID|SV-217023r604135_rule

STIG-ID|JUNI-RT-000180

STIG-Legacy|SV-101041

STIG-Legacy|V-90831

Vuln-ID|V-217023

JUNI-RT-000190 - The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.

Rule-ID|SV-217024r604135_rule

STIG-ID|JUNI-RT-000190

STIG-Legacy|SV-101043

STIG-Legacy|V-90833

Vuln-ID|V-217024

JUNI-RT-000200 - The Juniper router must be configured to log all packets that have been dropped - @FILTER_INBOUND_EXTERNAL@

CCI|CCI-000134

Rule-ID|SV-217025r604135_rule

STIG-ID|JUNI-RT-000200

STIG-Legacy|SV-101045

STIG-Legacy|V-90835

Vuln-ID|V-217025

JUNI-RT-000200 - The Juniper router must be configured to log all packets that have been dropped - syslog

JUNI-RT-000210 - The Juniper router must be configured to produce audit records containing information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-217026r604135_rule

STIG-ID|JUNI-RT-000210

STIG-Legacy|SV-101047

STIG-Legacy|V-90837

Vuln-ID|V-217026

JUNI-RT-000220 - The Juniper router must be configured to produce audit records containing information to establish the source of the events.

CCI|CCI-000133

Rule-ID|SV-217027r604135_rule

STIG-ID|JUNI-RT-000220

STIG-Legacy|SV-101049

STIG-Legacy|V-90839

Vuln-ID|V-217027

JUNI-RT-000230 - The Juniper router must be configured to disable the auxiliary port unless it is connected to a secured modem providing encryption and authentication.

Rule-ID|SV-217028r604135_rule

STIG-ID|JUNI-RT-000230

STIG-Legacy|SV-101051

STIG-Legacy|V-90841

Vuln-ID|V-217028

JUNI-RT-000235 - The Juniper router must not be configured to use IPv6 Site Local Unicast addresses.

Rule-ID|SV-233293r604135_rule

STIG-ID|JUNI-RT-000235

Vuln-ID|V-233293

JUNI-RT-000240 - The Juniper perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

CCI|CCI-001109

Rule-ID|SV-217029r604135_rule

STIG-ID|JUNI-RT-000240

STIG-Legacy|SV-101053

STIG-Legacy|V-90843

Vuln-ID|V-217029

JUNI-RT-000250 - The Juniper perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

Rule-ID|SV-217030r604135_rule

STIG-ID|JUNI-RT-000250

STIG-Legacy|SV-101055

STIG-Legacy|V-90845

Vuln-ID|V-217030

JUNI-RT-000260 - The Juniper perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Rule-ID|SV-217031r604135_rule

STIG-ID|JUNI-RT-000260

STIG-Legacy|SV-101057

STIG-Legacy|V-90847

Vuln-ID|V-217031

JUNI-RT-000270 - The Juniper perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - filter

Rule-ID|SV-217032r604135_rule

STIG-ID|JUNI-RT-000270

STIG-Legacy|SV-101059

STIG-Legacy|V-90849

Vuln-ID|V-217032

JUNI-RT-000270 - The Juniper perimeter router must be configured to block inbound packets with source Bogon IP address prefixes - prefix-list

JUNI-RT-000280 - The Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-217033r604135_rule

STIG-ID|JUNI-RT-000280

STIG-Legacy|SV-101061

STIG-Legacy|V-90851

Vuln-ID|V-217033

JUNI-RT-000290 - The Juniper perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider - BGP peer to an alternate gateway service provider.

Rule-ID|SV-217034r604135_rule

STIG-ID|JUNI-RT-000290

STIG-Legacy|SV-101063

STIG-Legacy|V-90853

Vuln-ID|V-217034

JUNI-RT-000300 - The Juniper perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-217035r604135_rule

STIG-ID|JUNI-RT-000300

STIG-Legacy|SV-101065

STIG-Legacy|V-90855

Vuln-ID|V-217035

JUNI-RT-000310 - The Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

CCI|CCI-001094

Rule-ID|SV-217036r604135_rule

STIG-ID|JUNI-RT-000310

STIG-Legacy|SV-101067

STIG-Legacy|V-90857

Vuln-ID|V-217036

JUNI-RT-000320 - The Juniper perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DoD Instruction 8551.1.

Rule-ID|SV-217037r604135_rule

STIG-ID|JUNI-RT-000320

STIG-Legacy|SV-101069

STIG-Legacy|V-90859

Vuln-ID|V-217037

JUNI-RT-000330 - The Juniper perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Detections

Analytics

DISA STIG Juniper Router RTR v2r3

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.1 Oct 11, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.0 Jun 28, 2022 Miscellaneous Metadata updated.