STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

DISA Rule

SV-273572r1110908_rule

Vulnerability Number

V-273572

Group Title

SRG-NET-000018-RTR-000004

Rule Version

RCKS-RTR-000040

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure a prefix list and apply to the eBGP neighbor configuration:

ip prefix-list customer1 seq 5 permit x.x.1.0/24 le 32
ip prefix-list customer1 seq 10 deny 0.0.0.0/0 ge 8

route-map bgp_cust1 permit 10
match ip address prefix-list customer1

router bgp
local-as 1001
neighbor x.x.x.x remote-as 500
neighbor x.x.x.x route-map in bgp_cust1

Check Contents

Review the router configuration to verify there are filters defined to only accept routes for prefixes that belong to specific customers.

1. Verify a prefix-list exists for the customer ("show running-config | include prefix") similar to the following:
ip prefix-list customer1 seq 5 permit x.x.1.0/24 le 32
ip prefix-list customer1 seq 10 deny 0.0.0.0/0 ge 8

2. Confirm the prefix list has been applied to eBGP neighbor similar to the following:
route-map bgp_cust1 permit 10
match ip address prefix-list customer1

router bgp
local-as 1001
neighbor x.x.x.x remote-as 500
neighbor x.x.x.x route-map in bgp_cust1

If the RUCKUS ICX router is not configured to reject prefixes not allocated to the customer, this is a finding.

Vulnerability Number

V-273572

Documentable

False

Rule Version

RCKS-RTR-000040

Severity Override Guidance

Review the router configuration to verify there are filters defined to only accept routes for prefixes that belong to specific customers.

1. Verify a prefix-list exists for the customer ("show running-config | include prefix") similar to the following:
ip prefix-list customer1 seq 5 permit x.x.1.0/24 le 32
ip prefix-list customer1 seq 10 deny 0.0.0.0/0 ge 8

2. Confirm the prefix list has been applied to eBGP neighbor similar to the following:
route-map bgp_cust1 permit 10
match ip address prefix-list customer1

router bgp
local-as 1001
neighbor x.x.x.x remote-as 500
neighbor x.x.x.x route-map in bgp_cust1

If the RUCKUS ICX router is not configured to reject prefixes not allocated to the customer, this is a finding.

Check Content Reference

M

Target Key

5696