Perimeter Router STIG Juniper Version Comparison

There are 2 differences between versions v8 r30 (July 27, 2018) (the "left" version) and v8 r32 (Jan. 25, 2019) (the "right" version).

Check NET-SRVFRM-003 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Check Content

Review the device configuration firewall protecting the server farm to validate an ACL with a deny-by-default security posture has been implemented that secures the servers located on the VLAN. If the filter is not defined on the firewall and the architecture contains a layer 3 switch between the firewall and the server server, then review the ACL configured for the VLAN interface. on the L3 switch.

Discussion

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.

Fix

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.