STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

DISA Rule

SV-273580r1110910_rule

Vulnerability Number

V-273580

Group Title

SRG-NET-000019-RTR-000002

Rule Version

RCKS-RTR-000120

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

1. Configure the access-list. In this example, SSL traffic is permitted to a specific internal host.
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

2. Apply access list to external interface.
interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!

Check Contents

Check perimeter router configuration for port connected to DISN for access-list filter to control flow of information between interconnected networks in accordance with applicable policy.

In this example, SSL traffic is permitted to a specific internal host:
interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

If the router does not enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy, this is a finding.

Vulnerability Number

V-273580

Documentable

False

Rule Version

RCKS-RTR-000120

Severity Override Guidance

Check perimeter router configuration for port connected to DISN for access-list filter to control flow of information between interconnected networks in accordance with applicable policy.

In this example, SSL traffic is permitted to a specific internal host:
interface ethernet 1/1/10
port-name Link_to_DISN
ip address x.12.1.10 255.255.255.0
ip access-group Filter_Perimeter in
!
ip access-list extended Filter_Perimeter
sequence 10 permit tcp any any established
sequence 20 permit tcp host x.12.1.9 host x.12.1.10 eq bgp
sequence 30 permit tcp host x.12.1.9 eq bgp host x.12.1.10
sequence 40 permit icmp host x.12.1.9 host x.12.1.10 echo
sequence 50 permit icmp host x.12.1.9 host x.12.1.10 echo-reply
sequence 60 permit tcp any host x.12.1.22 eq ssl
sequence 70 deny ip any any log

If the router does not enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy, this is a finding.

Check Content Reference

M

Target Key

5696