The Juniper router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-254036 | SRG-NET-000362-RTR-000115 | JUEX-RT-000640 | SV-254036r844141_rule | 2024-06-10 | 2 |
| Description |
|---|
| The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Redirect ICMP messages are commonly used by attackers for network mapping and diagnosis. |
| ℹ️ Check |
|---|
| Review the device configuration to determine if controls have been defined to ensure the router does not send ICMP Redirect messages out to any external interfaces. Verify the global "no-redirects" statement is enabled under [edit system] or that individual interface "no-redirects" statements are configured on external interfaces. [edit system] no-redirects; [edit interfaces] <external interface name> { unit <number> { family inet { no-redirects; address <IPv4 address>.<mask>; } family inet6 { no-redirects; address <IPv6 address>.<prefix>; } } } If ICMP Redirect messages are enabled on any external interfaces, this is a finding. |
| ✔️ Fix |
|---|
| Disable ICMP redirects on all external interfaces. set system no-redirects set interfaces <external interface name> unit <number> family inet no-redirects set interfaces <external interface name> unit <number> family inet6 no-redirects |