STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

DISA Rule

SV-273574r1110883_rule

Vulnerability Number

V-273574

Group Title

SRG-NET-000018-RTR-000006

Rule Version

RCKS-RTR-000060

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure all ASBRs to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

ICX(config-bgp-router)# neighbor x.x.x.x remote-as yyyy
ICX(config-bgp-router)# neighbor x.x.x.x enforce-first-as enable

Check Contents

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

router bgp
local-as 1000
neighbor 10.1.1.1 remote-as 1100
neighbor 10.1.1.1 enforce-first-as enable

If the router is not configured to enforce the first AS in the AS_PATH attribute for eBGP peers, this is a finding.

Vulnerability Number

V-273574

Documentable

False

Rule Version

RCKS-RTR-000060

Severity Override Guidance

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

router bgp
local-as 1000
neighbor 10.1.1.1 remote-as 1100
neighbor 10.1.1.1 enforce-first-as enable

If the router is not configured to enforce the first AS in the AS_PATH attribute for eBGP peers, this is a finding.

Check Content Reference

M

Target Key

5696