STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

DISA Rule

SV-273582r1110912_rule

Vulnerability Number

V-273582

Group Title

SRG-NET-000019-RTR-000004

Rule Version

RCKS-RTR-000140

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Create and apply neighbor filter list(s) as needed:

ip access-list standard PIM_NEIGHBORS
sequence 10 permit host x.1.2.6
!
interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip pim-sparse
ip pim neighbor-filter PIM_NEIGHBORS
!

Check Contents

This requirement is not applicable for the DODIN Backbone.

Verify on all PIM enabled interfaces, there is a neighbor filter applied:

interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip pim-sparse
ip pim neighbor-filter PIM_NEIGHBORS
!
ip access-list standard PIM_NEIGHBORS
sequence 10 permit host x.1.2.6
!

If an interface is enabled for PIM without a neighbor filter list, this is a finding.

Vulnerability Number

V-273582

Documentable

False

Rule Version

RCKS-RTR-000140

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Verify on all PIM enabled interfaces, there is a neighbor filter applied:

interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip pim-sparse
ip pim neighbor-filter PIM_NEIGHBORS
!
ip access-list standard PIM_NEIGHBORS
sequence 10 permit host x.1.2.6
!

If an interface is enabled for PIM without a neighbor filter list, this is a finding.

Check Content Reference

M

Target Key

5696