JUEX-L2-000200 - The Juniper EX switch must not be configured with VLANs used for L2 control traffic assigned to any host-facing access interface.

Information

In a switched Ethernet network, some protocols use L2 Protocol Data Units (PDU) to communicate in-band management or other control information. This control traffic is inappropriate for host-facing access interfaces because those devices are not part of the switching infrastructure. Juniper switches do not automatically carry this L2 control traffic in the default VLAN or automatically assign the default VLAN to all trunks, reducing the scope of potential misuse. Preventing host-facing access interfaces from participating in the L2 control traffic communications further reduces the risk of inadvertent (or malicious) interference.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Assign all access interfaces to a VLAN not used for L2 control traffic.

Interface range configuration:
set interfaces interface-range name member <interface name>
set interfaces interface-range name member-range <starting interface name> to <ending interface name>
set interfaces interface-range name unit 0 family ethernet-switching vlan members <vlan name>

Individual interface configuration:
set interfaces <interface name> unit 0 family ethernet-switching vlan members <vlan name>

Configure the VLAN:
set vlans <vlan name> vlan-id <VLAN ID>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CAT|II, CCI|CCI-004891, Rule-ID|SV-253967r997518_rule, STIG-ID|JUEX-L2-000200, Vuln-ID|V-253967

Plugin: Juniper

Control ID: cf4be3ffacdb6dfebf2d8af1c20b0cae6d00f21dc21283fd9d633f3e9f0a06ee