Skip to content

Support



Juniper was the first North American IP routing vendor to achieve the prestigious TL 9000 certification by the Quality of Excellence for Suppliers of Telecommunications (QuEST) Forum in the router category, for design, development, provision and service and support.



What is J-Care?

It's the world-class service and support that you expect from a company that delivers the industry's best infrastructure and security products. With J-Care, you now have the confidence knowing that Juniper will do our part to keep you on top of the world!


Security Features for EX-series Switches Overview

JUNOS software is a network operating system that has been hardened through the separation of control forwarding and services planes, with each function running in protected memory. The control-plane CPU is protected by rate limiting, routing policy, and firewall filters to ensure switch uptime even under severe attack. In addition, the switches fully integrate with the Juniper Network Unified Access Control (UAC) product to provide both standards-based 802.1X port-level access and Layer 2 through Layer 4 policy enforcement based on user identity. Access port security features such as dynamic ARP inspection, DHCP snooping, and MAC limiting are controlled through a single JUNOS CLI command.

EX-series switches provide the following hardware and software security features:

Console Port—Allows use of the console port to connect to the Routing Engine through an RJ-45 cable. You then use the command-line interface (CLI) to configure the switch. You can disable the console port.

Out-of-Band Management—A dedicated management Ethernet port on the rear panel allows out-of-band management.

Software Images—All JUNOS software images are signed by Juniper Networks certificate authority (CA) with public key infrastructure (PKI).

User Authentication, Authorization, and Accounting (AAA)—Features include:

  • User and group accounts with password encryption and authentication.
  • Access privilege levels configurable for login classes and user templates.
  • RADIUS authentication, TACACS+ authentication, or both, for authenticating users who attempt to access the switch.
  • Auditing of configuration changes through system logging or RADIUS/TACACS+.

IP Security (IPSec) Architecture—Provides a security suite for the network layer. IPSec functionality includes origin authentication, data integrity, confidentiality, replay protection, and nonrepudiation of source. IPSec also defines mechanisms for key generation and exchange, management of security associations, and support for digital certificates, and it supports secure communication across Routing Engines.

802.1X Authentication—Provides network access control. Supplicants (hosts) are authenticated when they initially connect to a LAN. Authenticating supplicants before they receive an IP address from a DHCP server prevents unauthorized supplicants from gaining access to the LAN. EX-series switches support Extensible Authentication Protocol (EAP) methods, including EAP-MD5, EAP-TLS, EAP-TTLS, and EAP-PEAP.

Port Security—Access port security features include:

  • DHCP snooping—Filters and blocks ingress DHCP server messages on untrusted ports; builds and maintains an IP-address/MAC-address binding database (called the DHCP snooping database).
  • Dynamic ARP inspection (DAI)—Prevents ARP spoofing attacks. ARP requests and replies are compared against entries in the DHCP snooping database, and filtering decisions are made based on the results of those comparisons.
  • MAC limiting—Protects against flooding of the Ethernet switching table.
  • MAC move limiting—Detects MAC movement and MAC spoofing on access ports. Prevents hosts whose MAC addresses have not been learned by the switch from accessing the network.
  • Trusted DHCP server—With a DHCP server on a trusted port, protects against rogue DHCP servers sending leases.

Firewall Filters—Allows auditing of various types of security violations, including attempts to access the switch from unauthorized locations. Firewall filters can detect such attempts and create audit log entries when they occur. The filters can also restrict access by limiting traffic to source and destination MAC addresses, specific protocols, or, in combination with policers, to specified data rates to prevent denial of service (DoS) attacks

Policers—Providse rate-limiting capability to control the amount of traffic that enters an interface, which acts to counter DoS attacks.

Encryption Standards—Supported standards include:

  • 128-, 192-, and 256-bit Advanced Encryption Standard (AES)
  • 56-bit Data Encryption Standard (DES) and 168-bit 3DES