Detections
Analytics
JUEX-RT-000470 - The Juniper out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).
Information
The OOBM network is an IP network used exclusively for the transport of OAM&P data from the network being managed to the OSS components located at the NOC. Its design provides connectivity to each managed network device, enabling network management traffic to flow between the managed network elements and the NOC. This allows the use of paths separate from those used by the managed network.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure appropriate prefix lists and firewall filters. For example:set policy-options prefix-list NOC-ipv4 <IPv4 network>/<mask>
set policy-options prefix-list NOC-ipv6 <IPv6 network>/<prefix>
set firewall family inet filter permit-NOC-ipv4 term 1 from destination-prefix-list NOC-ipv4
set firewall family inet filter permit-NOC-ipv4 term 1 from protocol <protocol>
set firewall family inet filter permit-NOC-ipv4 term 1 from destination-port [ <port 1> <port 2> ]
set firewall family inet filter permit-NOC-ipv4 term 1 then accept
<additional permit terms>
set firewall family inet filter permit-NOC-ipv4 term default then log
set firewall family inet filter permit-NOC-ipv4 term default then syslog
set firewall family inet filter permit-NOC-ipv4 term default then discard
set firewall family inet6 filter permit-NOC-ipv6 term 1 from destination-prefix-list NOC-ipv6
set firewall family inet6 filter permit-NOC-ipv6 term 1 from next-header <protocol>
set firewall family inet6 filter permit-NOC-ipv6 term 1 from destination-port [ <port 1> <port 2> ]
set firewall family inet6 filter permit-NOC-ipv6 term 1 then accept
<additional permit terms>
set firewall family inet6 filter permit-NOC-ipv6 term default then log
set firewall family inet6 filter permit-NOC-ipv6 term default then syslog
set firewall family inet6 filter permit-NOC-ipv6 term default then discard
Apply firewall filter to OOBM interface:
set interfaces <OOBM interface> unit <number> family inet filter output NOC-ipv4
set interfaces <OOBM interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <OOBM interface> unit <number> family inet6 filter output NOC-ipv6
set interfaces <OOBM interface> unit <number> family inet6 address <IPv6 address>/<prefix>
If using IPsec tunnel:
set rib inet6.0 static route <NOC IPv6 network> next-hop <(tunnel interface | NOC IPv6 tunnel endpoint address)>
set static route <NOC IPv4 network> next-hop <(tunnel interface | NOC IPv4 tunnel endpoint address)>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip
Item Details
Audit Name: DISA Juniper EX Series Router v2r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-254019r844090_rule, STIG-ID|JUEX-RT-000470, Vuln-ID|V-254019
Plugin: Juniper
Control ID: 1c9a912394130b746ca04acd9750ff68c81fbda3aa004d0a844053b54b7391e7