STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper P router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.

DISA Rule

SV-217080r639663_rule

Vulnerability Number

V-217080

Group Title

SRG-NET-000193-RTR-000114

Rule Version

JUNI-RT-000750

Severity

CAT III

CCI(s)

• CCI-001095 - The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure all P router interfaces and PE core-facing interfaces to use a configured or the default BA classifier as shown in the example below.

[edit class-of-service interfaces]
set ge-0/0/1 unit 0 classifiers dscp default
set ge-0/1/0 unit 0 classifiers dscp default
set ge-1/0/1 unit 0 classifiers dscp default
set ge-1/1/0 unit 0 classifiers dscp default

Note: The GTP QOS document (GTP-0009) can be downloaded via the following link:
https://intellipedia.intelink.gov/wiki/Portal:GIG_Technical_Guidance/GTG_GTPs/GTP_Development_List

Check Contents

Review the router configuration and verify that it has been configured to enforce a QoS policy in accordance with the QoS GIG Technical Profile (GTP-0009). The router must be configured to use either configured or default Behavior Aggregate (BA) classifier on all interfaces as shown in the example below:

class-of-service {
…
…
…
}
interfaces {
ge-0/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-0/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}

Note: The GTP QOS document (GTP-0009) can be downloaded via the following link:
https://intellipedia.intelink.gov/wiki/Portal:GIG_Technical_Guidance/GTG_GTPs/GTP_Development_List

If the router is not configured to enforce a QoS policy in accordance with the QoS GIG Technical Profile, this is a finding.

Vulnerability Number

V-217080

Documentable

False

Rule Version

JUNI-RT-000750

Severity Override Guidance

Review the router configuration and verify that it has been configured to enforce a QoS policy in accordance with the QoS GIG Technical Profile (GTP-0009). The router must be configured to use either configured or default Behavior Aggregate (BA) classifier on all interfaces as shown in the example below:

class-of-service {
…
…
…
}
interfaces {
ge-0/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-0/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/0/1 {
unit 0 {
classifiers {
dscp default;
}
}
}
ge-1/1/0 {
unit 0 {
classifiers {
dscp default;
}
}
}

Note: The GTP QOS document (GTP-0009) can be downloaded via the following link:
https://intellipedia.intelink.gov/wiki/Portal:GIG_Technical_Guidance/GTG_GTPs/GTP_Development_List

If the router is not configured to enforce a QoS policy in accordance with the QoS GIG Technical Profile, this is a finding.

Check Content Reference

M

Target Key

4032

Comments