JUEX-L2-000240 - The Juniper EX switch must not have a native VLAN ID assigned, or have a unique native VLAN ID, for all 802.1q trunk links.

Information

By default, Juniper switches do not assign a native VLAN to any trunked interface. Allowing trunked interfaces to accept untagged data packets may unintentionally expose VLANs to unauthorized devices that could result in network exploration, unauthorized resource access, or a DoS condition. If a network function requires a native VLAN it must be unique.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To ensure the integrity of the trunk link, either remove the native VLAN ID or configure the native VLAN ID with a unique value. If used, the native VLAN ID must be the same on both ends of the trunk link.

Example deleting a native VLAN ID:
delete interfaces <interface name> native-vlan-id

Example configuring a native VLAN ID:
set interfaces <interface name> native-vlan-id <VLAN ID not 1>

Example configuring a VLAN used as native for any trunked interface:
set vlans vlan_name vlan-id 30

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253971r843946_rule, STIG-ID|JUEX-L2-000240, Vuln-ID|V-253971

Plugin: Juniper

Control ID: 270e3eec58c3cc9197923d3b544ab9453f7a74ea64d77c336b7dce3c75ba7bf8