The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy so that all customer traffic receives forwarding treatment as specified in the service level agreement (SLA).

From Juniper Router RTR Security Technical Implementation Guide

Part of SRG-NET-000193-RTR-000109

Associated with: CCI-001095

JUNI-RT-000760_rule The Juniper PE router must be configured to enforce a Quality-of-Service (QoS) policy so that all customer traffic receives forwarding treatment as specified in the service level agreement (SLA).

Vulnerability discussion

QoS enables DISA to offer value-added IP services in accordance with SLAs, ensuring that customer requirements can be met while providing a method to provision the edge and core to accommodate those requirements.The IP core will recognize and provide forwarding treatment of customer traffic according to the Differentiated Services Code Points (DSCP). Customers marking traffic within their DiffServ domain will be required to comply with the DSCP classification that has been approved by the DOD QoS Working Group. Non-compliance could enable a customer or even an attacker to rob bandwidth from other customers or mission-critical services.

Check content

Verify that a filter has been configured to classify customer's traffic based on protocol and ports as shown in the example below. firewall { family inet { … … … } filter CLASSIFY_CUST1_TRAFFIC { term SIP { from { protocol tcp; port 5060; } then { forwarding-class expedited-forwarding; accept; } } term RTP { from { protocol udp; port 16384-32767; } then { forwarding-class expedited-forwarding; accept; } } term APP1 { from { protocol tcp; port nnnn; } then { loss-priority low; forwarding-class assured-forwarding; accept; } } term APP2 { from { protocol tcp; port nnnn; } then { loss-priority high; forwarding-class assured-forwarding; accept; } } term ACCEPT_OTHER { then { forwarding-class best-effort; accept; } } } } Verify that the classifier filter is bound to all CE-facing interfaces as shown in the example below. interfaces { ge-0/0/0 { description "Customer 1"; unit 0 { family inet { filter { CLASSIFY_CUST1_TRAFFIC } address x.x.x.x/30; } } } Verify that drop profiles and schedulers have been configured that define how queued egress packets are prioritized. class-of-service { drop-profiles { LOW_DROP { fill-level 95 drop-probability 0; fill-level 100 drop-probability 100; } HIGH_DROP { fill-level 50 drop-probability 10; fill-level 95 drop-probability 100; } } schedulers { VOIP_SCHED { transmit-rate percent 10; buffer-size percent 10; priority high; } APP1_SCHED { transmit-rate percent 20; buffer-size percent 20; priority medium-high; drop-profile-map loss-priority low protocol any drop-profile LOW_DROP; } APP2_SCHED { transmit-rate percent 10; buffer-size percent 10; priority medium-low; drop-profile-map loss-priority high protocol any drop-profile HIGH_DROP; } BEST_EFFORT_SCHED { transmit-rate percent 60; buffer-size percent 60; priority low; } } } Verify that scheduler maps have been configured to link the forwarding classes to schedulers as shown in the example below. class-of-service { … … … } scheduler-maps { QOS_SCHED_MAP { forwarding-class expedited-forwarding scheduler VOIP_SCHED; forwarding-class network-control scheduler APP1_SCHED; forwarding-class assured-forwarding scheduler APP2_SCHED; forwarding-class best-effort scheduler BEST_EFFORT_SCHED; } } Verify that the configured QoS scheduler map and the rewrite rules have been applied to all core-facing interfaces as shown in the example below. class-of-service { … … … } interfaces { ge-0/0/1 { scheduler-map QOS_SCHED_MAP; unit 0 { rewrite-rules { dscp default; } } } ge-0/1/1 { scheduler-map QOS_SCHED_MAP; unit 0 { rewrite-rules { dscp default; } } } If the PE router does not enforce a QoS policy to ensure that all customer traffic receives forwarding treatment as specified in the SLA, this is a finding.

Fix text

Configure a QoS policy to provide traffic forwarding treatment as specified in the SLA. The PE router must classify ingress traffic entering the backbone. Configure a filter to classify traffic based on protocol and ports as shown in the example below. [edit firewall family inet filter CLASSIFY_CUST1_TRAFFIC] set term SIP from protocol tcp set term SIP from port 5060 set term SIP then forwarding-class expedited-forwarding set term SIP then accept set term RTP from protocol udp set term RTP from port 16384-32767 set term RTP then forwarding-class expedited-forwarding set term RTP then accept set term APP1 from protocol tcp set term APP1 from port nnnn set term APP1then forwarding-class assured-forwarding loss-priority low set term APP1 then accept set term APP2 from protocol tcp set term APP2 from port nnnn set term APP2 then forwarding-class assured-forwarding loss-priority high set term APP2 then accept set term ACCEPT_OTHER then forwarding-class best-effort set term ACCEPT_OTHER then accept Configure drop profiles. [edit class-of-service] set drop-profiles LOW_DROP fill-level 95 drop-probability 0 set drop-profiles LOW_DROP fill-level 100 drop-probability 100 set drop-profiles HIGH_DROP fill-level 50 drop-probability 10 set drop-profiles HIGH_DROP fill-level 95 drop-probability 100 Configure QoS schedulers to define how queued egress packets are prioritized. [edit class-of-service schedulers] set VOIP_SCHED transmit-rate percent 10 set VOIP_SCHED buffer-size percent 10 set VOIP_SCHED priority high set APP1_SCHED transmit-rate percent 20 set APP1_SCHED buffer-size percent 20 set APP1_SCHED priority medium-low set APP1_SCHED drop-profile-map protocol any loss-priority low drop-profile LOW_DROP set APP2_SCHED transmit-rate percent 10 set APP2_SCHED buffer-size percent 10 set APP2_SCHED priority medium-low set APP2_SCHED drop-profile-map protocol any loss-priority high drop-profile HIGH_DROP set BEST_EFFORT_SCHED transmit-rate percent 60 set BEST_EFFORT_SCHED buffer-size percent 60 set BEST_EFFORT_SCHED priority low Configure scheduler maps to link the forwarding classes to schedulers. [edit class-of-service scheduler-maps QOS_SCHED_MAP] set forwarding-class expedited-forwarding scheduler VOIP_SCHED set forwarding-class assured-forwarding scheduler APP1_SCHED set forwarding-class assured-forwarding scheduler APP2_SCHED set forwarding-class best-effort scheduler BEST_EFFORT_SCHED Apply the filter that classifies traffic inbound on all CE-facing interfaces [edit interfaces ge-0/1/0 unit 0] set family inet filter input CLASSIFY_CUST1_TRAFFIC Apply the scheduler map to all core-facing interfaces as shown in the example. [edit class-of-service interfaces] set ge-0/0/1 scheduler-map QOS_SCHED_MAP set ge-0/1/1 scheduler-map QOS_SCHED_MAP Apply the rewrite rules to mark egress packets on all core-facing interfaces as shown in the example. [edit class-of-service interfaces] set ge-0/0/1 unit 0 rewrite-rules dscp default set ge-0/1/1 unit 0 rewrite-rules dscp default

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer