STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 Router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

DISA Rule

SV-269849r1137893_rule

Vulnerability Number

V-269849

Group Title

SRG-NET-000018-RTR-000001

Rule Version

OS10-RTR-000010

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure ACLs to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

Step 1: Configure named ACL with appropriate filter rules.

OS10(config)# ip access-list FILTER_EXTERNAL_INGRESS
OS10(config-ipv4-acl)# deny ip 10.0.0.0/8 any log
OS10(config-ipv4-acl)# deny tcp any any eq 23
OS10(config-ipv4-acl)# permit ip any any
OS10(config-ipv4-acl)# exit

Step 2: Apply the ACLs on the appropriate external and internal interfaces.

OS10(config-ipv4-acl)# interface ethernet1/1/4
OS10(conf-if-eth1/1/4)# ip access-group FILTER_EXTERNAL_INGRESS in

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that access control lists (ACLs) are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

These filters should be applied inbound or outbound on the appropriate external and internal interfaces.

Review the ACL configuration with the "show ip access-lists in" and "show ip access-lists out" commands.

OS10# show ip access-lists in
Ingress IP access-list FILTER_EXTERNAL_INGRESS
Active on interfaces :
ethernet1/1/4
seq 10 deny ip 10.0.0.0/8 any log
seq 20 deny tcp any any eq 23
seq 30 permit ip any any

If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Vulnerability Number

V-269849

Documentable

False

Rule Version

OS10-RTR-000010

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that access control lists (ACLs) are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols.

These filters should be applied inbound or outbound on the appropriate external and internal interfaces.

Review the ACL configuration with the "show ip access-lists in" and "show ip access-lists out" commands.

OS10# show ip access-lists in
Ingress IP access-list FILTER_EXTERNAL_INGRESS
Active on interfaces :
ethernet1/1/4
seq 10 deny ip 10.0.0.0/8 any log
seq 20 deny tcp any any eq 23
seq 30 permit ip any any

If the router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Check Content Reference

M

Target Key

5668