Juniper SRX STIG Checklist

20 items · Security · Medium difficulty · 4 hours

Harden and validate Juniper SRX devices to meet DISA STIG requirements.

• Verify Junos software version meets DoD minimum (12.1X46) or later

  Record current version and planned upgrade target.

• Upgrade Junos to a supported, patched release if below minimum

  Schedule maintenance window and follow vendor upgrade steps.

• Harden the management plane

  Apply controls to protect RE and management interfaces.

• Enable SSH and disable insecure management protocols (telnet/http)

  Allow only encrypted management protocols (SSH/HTTPS) where required.

• Restrict management access to authorized IPs and management VRFs

  Use firewall filters or loopback/mgmt VRF for admin access.

• Configure role-based admin accounts and remove/disable default accounts

  Assign least privilege and unique admin usernames.

• Enforce strong authentication (AAA/TACACS+/RADIUS, MFA where possible)

  Integrate centralized auth and log authentication events.

• Configure centralized logging to a secure syslog/SIEM collector

  Send audit and event logs off-box in real time.

• Verify log retention, rotation, and audit settings

  Ensure logs meet retention and integrity requirements.

• Configure NTP with authenticated, trusted servers

  Prevent time drift and ensure accurate timestamps.

• Harden PFE firewall policies and rulebase per STIG guidance

  Audit policies for least privilege and explicit denies.

• Apply Application Layer Gateway (ALG) recommended settings

  Configure ALG per STIG to avoid insecure ALGs.

• Enable and tune IDPS features when implemented by PFE

  Apply signature tuning and drop/alert policies per STIG.

• Secure IPsec VPN configuration (IKE, ciphers, lifetimes) per STIG

  Use approved algorithms and certificate-based auth when possible.

• Disable unused services and shut down unused interfaces

  Remove or deny access to protocols and interfaces not required.

• Implement connection timeouts and session limits to mitigate resource exhaustion

  Adjust TCP/UDP timeouts and maximum sessions appropriately.

• Back up running configuration and store backups securely off-device

  Encrypt backups and verify restore process.

• Perform vulnerability scan and remediate identified findings

  Include OS, services, and configuration checks against STIG items.

• Document configuration changes, exceptions, and risk acceptances

  Keep evidence and authorizations for any STIG deviations.

• Schedule regular STIG compliance checks, patch cycles, and audits

  Define cadence and owners for ongoing compliance.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.