STIGQter STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

DISA Rule

SV-273570r1110906_rule

Vulnerability Number

V-273570

Group Title

SRG-NET-000018-RTR-000002

Rule Version

RCKS-RTR-000020

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure eBGP routers to reject inbound route advertisements for any Bogon prefixes.

1. Create the desired prefix list.
SSH@ICX(config)# ip prefix PREFIX-FLTR seq 5 deny 0.0.0.0/8 le 32
SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 10 deny 10.0.0.0/8 le 32
...
SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 999 permit 0.0.0.0/0 le 8

2. Apply to applicable BGP neighbors.
router bgp
neighbor x.x.x.x prefix-list PREFIX-FLTR in

Check Contents

Verify a prefix list exists in the config:
SSH@ICX(config)# show ip prefix-lists
ip prefix-list PREFIX-FLTR: 1 entries
seq 5 deny 0.0.0.0/8 le 32
seq 10 deny 10.0.0.0/8 le 32
...
seq 999 permit 0.0.0.0/0 le 8

Confirm that prefix list is applied to BGP:
router bgp
neighbor x.x.x.x prefix-list PREFIX-FLTR in

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Vulnerability Number

V-273570

Documentable

False

Rule Version

RCKS-RTR-000020

Severity Override Guidance

Verify a prefix list exists in the config:
SSH@ICX(config)# show ip prefix-lists
ip prefix-list PREFIX-FLTR: 1 entries
seq 5 deny 0.0.0.0/8 le 32
seq 10 deny 10.0.0.0/8 le 32
...
seq 999 permit 0.0.0.0/0 le 8

Confirm that prefix list is applied to BGP:
router bgp
neighbor x.x.x.x prefix-list PREFIX-FLTR in

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Check Content Reference

M

Target Key

5696