STIGQter: STIG Summary: Juniper Router NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 24 Jul 2020:

The Juniper router must be configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies.

DISA Rule

SV-101203r1_rule

Vulnerability Number

V-91103

Group Title

SRG-APP-000038-NDM-000213

Rule Version

JUNI-ND-000140

Severity

CAT II

CCI(s)

• CCI-001368 - The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Step 1: Configure the router to restrict management access to specific IP addresses via SSH as shown in the example below.

[edit firewall family inet]
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from source-address x.x.x.x/24
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from protocol tcp
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from port ssh
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH then accept
set filter RESTRICT_MGMT_ACCESS term DENY_SSH from protocol tcp
set filter RESTRICT_MGMT_ACCESS term DENY_SSH from port ssh
set filter RESTRICT_MGMT_ACCESS term DENY_SSH then log
set filter RESTRICT_MGMT_ACCESS term DENY_SSH then discard

Step 2: Apply the filter to the loopback interface.

[edit interfaces lo0 unit 0 family inet]
set filter input RESTRICT_MGMT_ACCESS

Note: Management and control plane traffic destined to the router is punted to the routing engine. Hence, applying the filter to the loopback ensures that this traffic can be monitored regardless of the ingress physical interface.

Step 1: Configure the router to restrict management access to specific IP addresses via SSH as shown in the example below.

[edit firewall family inet]
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from source-address x.x.x.x/24
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from protocol tcp
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH from port ssh
set filter RESTRICT_MGMT_ACCESS term ALLOW_SSH then accept
set filter RESTRICT_MGMT_ACCESS term DENY_SSH from protocol tcp
set filter RESTRICT_MGMT_ACCESS term DENY_SSH from port ssh
set filter RESTRICT_MGMT_ACCESS term DENY_SSH then log
set filter RESTRICT_MGMT_ACCESS term DENY_SSH then discard

Step 2: Apply the filter to the loopback interface.

[edit interfaces lo0 unit 0 family inet]
set filter input RESTRICT_MGMT_ACCESS

Note: Management and control plane traffic destined to the router is punted to the routing engine. Hence, applying the filter to the loopback ensures that this traffic can be monitored regardless of the ingress physical interface.

Check Contents

Review the router configuration to verify that it is compliant with this requirement.

Step 1: Verify that an input filter has been configured for the loopback interfaces as shown in the example below.

interfaces {
…
…
…
}
lo0 {
unit 0 {
family inet {
filter {
input RESTRICT_MGMT_ACCESS;
}
address 2.2.2.2/32;
}
}
}
}

Step 2: Verify that the filter restricts management traffic. The configuration example below restricts management access to specific IP addresses via SSH.

filter RESTRICT_MGMT_ACCESS {
term ALLOW_SSH {
from {
source-address {
x.x.x.x/24;
}
protocol tcp;
port ssh;
}
then accept;
}
term DENY_SSH {
from {
protocol tcp;
port ssh;
}
then {
log;
discard;
}
}
}

Note: Management and control plane traffic destined to the router is punted to the routing engine. Hence, applying the filter to the loopback ensures that this traffic can be monitored regardless of the ingress physical interface.

If the Juniper router is not configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies, this is a finding.

Vulnerability Number

V-91103

Documentable

False

Rule Version

JUNI-ND-000140

Severity Override Guidance

Review the router configuration to verify that it is compliant with this requirement.

Step 1: Verify that an input filter has been configured for the loopback interfaces as shown in the example below.

interfaces {
…
…
…
}
lo0 {
unit 0 {
family inet {
filter {
input RESTRICT_MGMT_ACCESS;
}
address 2.2.2.2/32;
}
}
}
}

Step 2: Verify that the filter restricts management traffic. The configuration example below restricts management access to specific IP addresses via SSH.

filter RESTRICT_MGMT_ACCESS {
term ALLOW_SSH {
from {
source-address {
x.x.x.x/24;
}
protocol tcp;
port ssh;
}
then accept;
}
term DENY_SSH {
from {
protocol tcp;
port ssh;
}
then {
log;
discard;
}
}
}

Note: Management and control plane traffic destined to the router is punted to the routing engine. Hence, applying the filter to the loopback ensures that this traffic can be monitored regardless of the ingress physical interface.

If the Juniper router is not configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies, this is a finding.

Check Content Reference

M

Target Key

3381

Comments