STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

DISA Rule

SV-273578r1110887_rule

Vulnerability Number

V-273578

Group Title

SRG-NET-000018-RTR-000010

Rule Version

RCKS-RTR-000100

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

1. Configure the AS_PATH filter list.
ICX(config)# ip as-path access-list BGP_filter seq 5 permit ^yy$
ICX(config)# ip as-path access-list BGP_filter seq 10 deny .*

2. Apply to BGP neighbor.
ICX(config)# router bgp
ICX(config-bgp-router)# neighbor x.x.x.x filter-list BGP_filter in

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review ICX router configuration for AS_PATH filter statements for BGP:
ip as-path access-list BGP_filter seq 5 permit ^yy$
ip as-path access-list BGP_filter seq 10 deny .*
!
router bgp
local-as xx
neighbor x.4.4.4 remote-as yy
neighbor x.4.4.4 filter-list BGP_filter in
!

If the ICX router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Vulnerability Number

V-273578

Documentable

False

Rule Version

RCKS-RTR-000100

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review ICX router configuration for AS_PATH filter statements for BGP:
ip as-path access-list BGP_filter seq 5 permit ^yy$
ip as-path access-list BGP_filter seq 10 deny .*
!
router bgp
local-as xx
neighbor x.4.4.4 remote-as yy
neighbor x.4.4.4 filter-list BGP_filter in
!

If the ICX router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Check Content Reference

M

Target Key

5696