STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Juniper SRX Services Gateway NDM Security Technical Implementation Guide

Version

V3R3

Release Date

Dec 20, 2024

SCAP Benchmark ID

Juniper_SRX_SG_NDM_STIG

Total Checks

68

Tags

network
CAT I: 8CAT II: 43CAT III: 17

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (68)

V-223180LOWThe Juniper SRX Services Gateway must limit the number of concurrent sessions to a maximum of 10 or less for remote access using SSH.V-223181MEDIUMFor local accounts created on the device, the Juniper SRX Services Gateway must automatically generate log records for account creation events.V-223182MEDIUMFor local accounts created on the device, the Juniper SRX Services Gateway must automatically generate log records for account modification events.V-223183MEDIUMFor local accounts created on the device, the Juniper SRX Services Gateway must automatically generate log records for account disabling events.V-223184MEDIUMFor local accounts created on the device, the Juniper SRX Services Gateway must automatically generate log records for account removal events.V-223185MEDIUMThe Juniper SRX Services Gateway must automatically generate a log event when accounts are enabled.V-223186MEDIUMThe Juniper SRX Services Gateway must enforce the assigned privilege level for each administrator and authorizations for access to all commands by assigning a login class to all AAA-authenticated users.V-223187LOWThe Juniper SRX Services Gateway must generate a log event when privileged commands are executed.V-223188LOWFor local accounts created on the device, the Juniper SRX Services Gateway must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.V-223189LOWThe Juniper SRX Services Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access.V-223191LOWThe Juniper SRX Services Gateway must generate log records when successful attempts to configure the device and use commands occur.V-223192LOWThe Juniper SRX Services Gateway must generate log records when changes are made to administrator privileges.V-223193LOWThe Juniper SRX Services Gateway must generate log records when administrator privileges are deleted.V-223194LOWThe Juniper SRX Services Gateway must generate log records when logon events occur.V-223195LOWThe Juniper SRX Services Gateway must generate log records when privileged commands are executed.V-223196LOWThe Juniper SRX Services Gateway must generate log records when concurrent logons from different workstations occur.V-223197LOWThe Juniper SRX Services Gateway must generate log records containing the full-text recording of privileged commands.V-223198MEDIUMFor local log files, the Juniper SRX Services Gateway must allocate log storage capacity in accordance with organization-defined log record storage requirements so that the log files do not grow to a size that causes operational issues.V-223199MEDIUMThe Juniper SRX Services Gateway must generate an immediate system alert message to the management console when a log processing failure is detected.V-223201MEDIUMThe Juniper SRX Services Gateway must record time stamps for log records using Coordinated Universal Time (UTC).V-223202MEDIUMThe Juniper SRX Services Gateway must implement logon roles to ensure only authorized roles are allowed to install software and updates.V-223203MEDIUMIf the loopback interface is used, the Juniper SRX Services Gateway must protect the loopback interface with firewall filters for known attacks that may exploit this interface.V-223204LOWThe Juniper SRX Services Gateway must have the number of rollbacks set to 5 or more.V-223205MEDIUMThe Juniper SRX Services Gateway must be configured to synchronize internal information system clocks with the primary and secondary NTP servers for the network.V-223206MEDIUMThe Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.V-223207MEDIUMThe Juniper SRX Services Gateway must use DOD-approved PKI rather than proprietary or self-signed device certificates.V-223208MEDIUMThe Juniper SRX Services Gateway must be configured to prohibit the use of unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-223209MEDIUMFor nonlocal maintenance sessions, the Juniper SRX Services Gateway must remove or explicitly deny the use of nonsecure protocols.V-223211HIGHThe Juniper SRX Services Gateway must use and securely configure SNMPv3 if SNMP is enabled.V-223212MEDIUMThe Juniper SRX Services Gateway must ensure SSH is disabled for root user logon to prevent remote access using the root account.V-223213MEDIUMThe Juniper SRX Services Gateway must ensure access to start a UNIX-level shell is restricted to only the root account.V-223214MEDIUMThe Juniper SRX Services Gateway must ensure TCP forwarding is disabled for SSH to prevent unauthorized access.V-223215MEDIUMThe Juniper SRX Services Gateway must be configured with only one local user account to be used as the account of last resort.V-223216MEDIUMThe Juniper SRX Services Gateway must implement replay-resistant authentication mechanisms for network access to privileged accounts.V-223217MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce a minimum 15-character password length.V-223218MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by setting the password change type to character sets.V-223219MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by requiring at least one uppercase character be used.V-223220MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by requiring at least one lowercase character be used.V-223221MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by requiring at least one numeric character be used.V-223222MEDIUMFor local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce password complexity by requiring at least one special character be used.V-223223HIGHThe Juniper SRX Services Gateway must use the SHA256 or later protocol for password authentication for local accounts using password authentication (i.e., the root account and the account of last resort).V-223224HIGHFor nonlocal maintenance sessions using SNMP, the Juniper SRX Services Gateway must use and securely configure SNMPv3 with SHA256 or higher to protect the integrity of maintenance and diagnostic communications.V-223225HIGHThe Juniper SRX Services Gateway must securely configure SSHv2 FIPS 140-2/140-3 validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.V-223226HIGHThe Juniper SRX Services Gateway must securely configure SNMPv3 with privacy options to protect the confidentiality of nonlocal maintenance and diagnostic communications using SNMP.V-223227HIGHThe Juniper SRX Services Gateway must use SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.V-223228MEDIUMFor nonlocal maintenance sessions, the Juniper SRX Services Gateway must ensure only zones where management functionality is desired have host-inbound-traffic system-services configured.V-223231MEDIUMThe Juniper SRX Services Gateway must terminate a device management session after 10 minutes of inactivity, except to fulfill documented and validated mission requirements.V-223232MEDIUMThe Juniper SRX Services Gateway must terminate a device management session if the keep-alive count is exceeded.V-223233MEDIUMThe Juniper SRX Services Gateway must configure the control plane to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself by configuring applicable system options and internet-options.V-223234MEDIUMThe Juniper SRX Services Gateway must limit the number of sessions per minute to an organization-defined number for SSH to protect remote access management from unauthorized access.V-223235LOWThe Juniper SRX Services Gateway must implement service redundancy to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself.V-223236MEDIUMThe Juniper SRX Services Gateway must be configured to use Junos 12.1 X46 or later to meet the minimum required version for DoD.V-223237HIGHFor nonlocal maintenance sessions, the Juniper SRX Services Gateway must explicitly deny the use of J-Web.V-229014MEDIUMThe Juniper SRX Services Gateway must automatically terminate a network administrator session after organization-defined conditions or trigger events requiring session disconnect.V-229015MEDIUMFor local accounts, the Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when local accounts are created.V-229016MEDIUMThe Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when the local accounts (i.e., the account of last resort or root account) are modified.V-229017MEDIUMThe Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when accounts are disabled.V-229018MEDIUMThe Juniper SRX Services Gateway must generate alerts to the management console and generate a log record that can be forwarded to the ISSO and designated system administrators when the local accounts (i.e., the account of last resort or root account) are deleted.V-229019MEDIUMThe Juniper SRX Services Gateway must generate an immediate alert message to the management console for account enabling actions.V-229021LOWThe Juniper SRX Services Gateway must allow only the information system security manager (ISSM) (or administrators/roles appointed by the ISSM) to select which auditable events are to be generated and forwarded to the syslog and/or local logs.V-229022LOWFor local logging, the Juniper SRX Services Gateway must generate a message to the system management console when a log processing failure occurs.V-229023MEDIUMIn the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally.V-229024MEDIUMThe Juniper SRX Services Gateway must be configured to use an authentication server to centrally apply authentication and logon settings for remote and nonlocal access for device management.V-229025HIGHThe Juniper SRX Services Gateway must be configured to use a centralized authentication server to authenticate privileged users for remote and nonlocal access for device management.V-229026LOWThe Juniper SRX Services Gateway must specify the order in which authentication servers are used.V-229027LOWThe Juniper SRX Services Gateway must detect the addition of components and issue a priority 1 alert to the ISSM and SA, at a minimum.V-229028MEDIUMThe Juniper SRX Services Gateway must generate an alarm or send an alert message to the management console when a component failure is detected.V-229029MEDIUMThe Juniper SRX Services Gateway must reveal log messages or management console alerts only to the ISSO, ISSM, and SA roles).