STIGQter STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 Router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.

DISA Rule

SV-269886r1052435_rule

Vulnerability Number

V-269886

Group Title

SRG-NET-000362-RTR-000110

Rule Version

OS10-RTR-000610

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Implement control plane protection by classifying traffic types based on importance and configure filters to restrict and rate limit the traffic directed to and processed by the RP according to each class.

Step 1: Create an appropriate QoS policy for CoPP.

OS10(config)# class-map type control-plane example-copp-class-map-name
OS10(config-cmap-control-plane)# exit
OS10(config)# policy-map type control-plane example-copp-policy-map-name
OS10(config-pmap-control-plane)# class example-copp-class-map-name
OS10(config-pmap-c)# set qos-group 2
OS10(config-pmap-c)# police cir 100 pir 100

Step 2: Assign the control-plane service-policy.

OS10(config)# control-plane
OS10(conf-control-plane)# service-policy input example-copp-policy-map-name

Check Contents

Determine whether control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class.

Use the show control-plane info command to review the Control Plane Policing (CoPP) policies.

OS10# show control-plane info
Queue Min Rate Limit(in pps) Max Rate Limit(in pps) Protocols
0 600 600 ISCSI UNKNOWN UNICAST
1 1000 1000 OPEN_FLOW SFLOW
2 400 400 IGMP PIM
3 600 1000 VLT NDS
4 500 1000 IPV6_ICMP IPV4_ICMP
5 500 1000 ICMPV6_RS ICMPV6_NS ICMPV6_RA ICMPV6_NA
6 500 1000 ARP_REQ SERVICEABILITY
7 500 1000 ARP_RESP
8 500 500 SSH TELNET TACACS NTP FTP
9 600 600 FCOE NVME
10 600 1000 LACP
11 400 400 RSTP PVST MSTP
12 500 500 DOT1X LLDP FEFD
13 600 1000 IPV6_OSPF IPV4_OSPF
14 600 1000 OSPF_HELLO
15 600 1000 BGP
16 500 500 IPV6_DHCP IPV4_DHCP
17 600 1000 VRRP
18 700 700 BFD
19 1400 2000 REMOTE CPS
20 300 300 MCAST DATA
21 100 100 ACL LOGGING
22 300 300 MCAST KNOWN DATA
23 100 100 PTP
24 100 100 PORT_SECURITY
OS10#

Use the show running-configuration class-map and policy-map to review configured CoPP policies.

OS10# show running-configuration class-map
!
class-map type application class-iscsi
!
class-map type control-plane example-copp-class-map-name
OS10#
OS10# show running-configuration policy-map
!
policy-map type application policy-iscsi
!
policy-map type control-plane example-copp-policy-map-name
!
class example-copp-class-map-name
set qos-group 2
police cir 100 pir 100
OS10#

Use the show qos control-plane command to review whether custom CoPP policies have been configured.

OS10# show qos control-plane
Service-policy (input): example-copp-policy-map-name

If the router does not have appropriate control plane protection implemented, this is a finding.

Vulnerability Number

V-269886

Documentable

False

Rule Version

OS10-RTR-000610

Severity Override Guidance

Determine whether control plane protection has been implemented on the device by verifying traffic types have been classified based on importance levels and a policy has been configured to filter and rate limit the traffic according to each class.

Use the show control-plane info command to review the Control Plane Policing (CoPP) policies.

OS10# show control-plane info
Queue Min Rate Limit(in pps) Max Rate Limit(in pps) Protocols
0 600 600 ISCSI UNKNOWN UNICAST
1 1000 1000 OPEN_FLOW SFLOW
2 400 400 IGMP PIM
3 600 1000 VLT NDS
4 500 1000 IPV6_ICMP IPV4_ICMP
5 500 1000 ICMPV6_RS ICMPV6_NS ICMPV6_RA ICMPV6_NA
6 500 1000 ARP_REQ SERVICEABILITY
7 500 1000 ARP_RESP
8 500 500 SSH TELNET TACACS NTP FTP
9 600 600 FCOE NVME
10 600 1000 LACP
11 400 400 RSTP PVST MSTP
12 500 500 DOT1X LLDP FEFD
13 600 1000 IPV6_OSPF IPV4_OSPF
14 600 1000 OSPF_HELLO
15 600 1000 BGP
16 500 500 IPV6_DHCP IPV4_DHCP
17 600 1000 VRRP
18 700 700 BFD
19 1400 2000 REMOTE CPS
20 300 300 MCAST DATA
21 100 100 ACL LOGGING
22 300 300 MCAST KNOWN DATA
23 100 100 PTP
24 100 100 PORT_SECURITY
OS10#

Use the show running-configuration class-map and policy-map to review configured CoPP policies.

OS10# show running-configuration class-map
!
class-map type application class-iscsi
!
class-map type control-plane example-copp-class-map-name
OS10#
OS10# show running-configuration policy-map
!
policy-map type application policy-iscsi
!
policy-map type control-plane example-copp-policy-map-name
!
class example-copp-class-map-name
set qos-group 2
police cir 100 pir 100
OS10#

Use the show qos control-plane command to review whether custom CoPP policies have been configured.

OS10# show qos control-plane
Service-policy (input): example-copp-policy-map-name

If the router does not have appropriate control plane protection implemented, this is a finding.

Check Content Reference

M

Target Key

5668