V2R1 changes
Juniper EX Series Switches Router STIG V2R1 (2024-07-24) replaced V1R3 (2023-04-27): 20 checks updated. It has 102 checks, against 102 in V1R3.
V2R1 checklistV1R3 checklist Compare V1R3 and V2R1 in STIG Compare
- 0 added
- 0 removed
- 20 updated
Updated fields: CCIs 20Discussion 2Title 1
Updated in V2R1 (20)
V-253989CAT IThe Juniper perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.Discussion, CCIs
Discussion
Enclaves with alternate gateway connections must take additional steps to ensure there is no compromise on the enclave network or NIPRNet. Without verifying the destination address of traffic coming from the site's alternate gateway, the perimeter router could be routing transit data from the internet into the NIPRNet. This could also make the perimeter router vulnerable to a denial-of-service (DoS) attack as well as provide a back door into the NIPRNet. The DoDDOD enclave must ensure the ingress filter applied to external interfaces on a perimeter router connecting to an Approved Gateway is secure through filters permitting packets with a destination address belonging to the DoDDOD enclave's address block.
CCIs
CCI-001414CCI-001414,CCI-004866
V-254006CAT IIThe Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.CCIs
V-254007CAT IIIThe Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS DODIN Technical Profile.CCIs
V-254008CAT IIIThe Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.Title, CCIs
Title
The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.
CCIs
CCI-001095CCI-001095,CCI-004931
V-254010CAT IThe Juniper router must be configured to restrict traffic destined to itself.CCIs
V-254011CAT IIThe Juniper router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.Discussion, CCIs
Discussion
Fragmented ICMP packets can be generated by hackers for denial-of-service (DoS) attacks such as Ping O' Death and Teardrop. It is imperative that all fragmented ICMP packets are dropped.
CCIs
CCI-001097CCI-001097,CCI-004866
V-254016CAT IThe Juniper PE router must be configured to block any traffic that is destined to IP core infrastructure.CCIs
V-254017CAT IIThe Juniper PE router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode, or a firewall filter, enabled on all CE-facing interfaces.CCIs
V-254018CAT IIThe Juniper out-of-band management (OOBM) gateway must be configured to transport management traffic to the Network Operations Center (NOC) via dedicated circuit, MPLS/VPN service, or IPsec tunnel.CCIs
V-254021CAT IIThe Juniper router must be configured to only permit management traffic that ingresses and egresses the OOBM interface.CCIs
V-254022CAT IThe Juniper perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).CCIs
V-254023CAT IIThe Juniper perimeter router must be configured to block all packets with any IP options.CCIs
V-254024CAT IIThe Juniper PE router must be configured to ignore or block all packets with any IP options.CCIs
V-254031CAT IIThe Juniper router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.CCIs
V-254033CAT IIIThe Juniper router must be configured to have IP directed broadcast disabled on all interfaces.CCIs
V-254040CAT IIIThe Juniper multicast RP router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of PIM and MSDP source-active entries.CCIs
V-254044CAT IIIThe Juniper BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).CCIs
V-254064CAT IThe Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance bound to the appropriate physical or logical interfaces to maintain traffic separation between all MPLS L3VPNs.CCIs
V-254065CAT IThe Juniper PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).CCIs
V-254068CAT IThe Juniper PE router providing Virtual Private LAN Services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.CCIs
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.