STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 Router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

DISA Rule

SV-269873r1052004_rule

Vulnerability Number

V-269873

Group Title

SRG-NET-000205-RTR-000002

Rule Version

OS10-RTR-000390

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Ensure all routers have their receive path filter configured to drop all fragmented ICMP packets.

Step 1: Configure a control-plane ACL that drops fragmented ICMP packets.

OS10(config)# ip access-list FILTER_FRAGMENTED_ICMP
OS10(config-ipv4-acl)# seq 10 deny icmp any any log fragment
OS10(config-ipv4-acl)# seq 20 permit ip any any

Step 2: Apply the ACL above to the control-plane.

OS10(config)# control-plane
OS10(config-control-plane)# ip access-group FILTER_FRAGMENTED_ICMP data in

Check Contents

Review the access control list (ACL) for the control plane receive path.

Verify that it will drop all fragmented ICMP packets destined to itself.

Step 1: Review the router configuration to verify that an ACL is configured that drops fragmented ICMP packets.

!
ip access-list FILTER_FRAGMENTED_ICMP
seq 10 deny icmp any any log fragment
...
seq 20 permit ip any any

Step 2: Examine the configuration to verify the ACL above is applied to packets destined to the control plane.

!
control-plane
ip access-group FILTER_FRAGMENTED_ICMP data in

Note: As shown above, OS10 can filter fragmented packets that arrive on the front panel data ports. OS10 does not support filtering fragmented packets arriving on the OOBM management ethernet interface.

If the router is not configured with a receive-path filter to drop all fragmented ICMP packets, this is a finding.

Vulnerability Number

V-269873

Documentable

False

Rule Version

OS10-RTR-000390

Severity Override Guidance

Review the access control list (ACL) for the control plane receive path.

Verify that it will drop all fragmented ICMP packets destined to itself.

Step 1: Review the router configuration to verify that an ACL is configured that drops fragmented ICMP packets.

!
ip access-list FILTER_FRAGMENTED_ICMP
seq 10 deny icmp any any log fragment
...
seq 20 permit ip any any

Step 2: Examine the configuration to verify the ACL above is applied to packets destined to the control plane.

!
control-plane
ip access-group FILTER_FRAGMENTED_ICMP data in

Note: As shown above, OS10 can filter fragmented packets that arrive on the front panel data ports. OS10 does not support filtering fragmented packets arriving on the OOBM management ethernet interface.

If the router is not configured with a receive-path filter to drop all fragmented ICMP packets, this is a finding.

Check Content Reference

M

Target Key

5668