STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the site's address space.

DISA Rule

SV-273585r1111051_rule

Vulnerability Number

V-273585

Group Title

SRG-NET-000019-RTR-000008

Rule Version

RCKS-RTR-000170

Severity

CAT I

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the ingress filter of the perimeter router connected to an alternate gateway to only permit packets with destination addresses of the site's NIPRNet address space or a destination address belonging to the address block assigned by the alternate gateway network service provider.

1. Configure an ACL that exists to allow only desired traffic (example includes SSL hosts).
ip access-list extended FILTER_ISP
sequence 10 permit tcp any any established
sequence 20 permit icmp host x.12.1.16 host x.12.1.17 echo
sequence 30 permit icmp host x.12.1.16 host x.12.1.17 echo-reply
sequence 40 permit tcp any host x.12.1.22 eq ssl
sequence 50 permit tcp any host x.12.1.23 eq ssl
sequence 60 permit esp any host x.12.1.24
sequence 70 permit ahp any host x.12.1.24
sequence 80 deny ip any any log
!

2. Apply the ACL to alternative gateway interface.
interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip access-group FILTER_ISP in
!

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the configuration of each router interface connecting to an alternate gateway.

1. Verify an ACL exists to allow only desired traffic (example includes SSL hosts).
ip access-list extended FILTER_ISP
sequence 10 permit tcp any any established
sequence 20 permit icmp host x.12.1.16 host x.12.1.17 echo
sequence 30 permit icmp host x.12.1.16 host x.12.1.17 echo-reply
sequence 40 permit tcp any host x.12.1.22 eq ssl
sequence 50 permit tcp any host x.12.1.23 eq ssl
sequence 60 permit esp any host x.12.1.24
sequence 70 permit ahp any host x.12.1.24
sequence 80 deny ip any any log
!

2. Check that ACL is applied to alternative gateway interface.
interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip access-group FILTER_ISP in
!

If the alternative gateway interface is not configured with an ACL permitting only the destination addresses in the sites address space, this is a finding.

Vulnerability Number

V-273585

Documentable

False

Rule Version

RCKS-RTR-000170

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the configuration of each router interface connecting to an alternate gateway.

1. Verify an ACL exists to allow only desired traffic (example includes SSL hosts).
ip access-list extended FILTER_ISP
sequence 10 permit tcp any any established
sequence 20 permit icmp host x.12.1.16 host x.12.1.17 echo
sequence 30 permit icmp host x.12.1.16 host x.12.1.17 echo-reply
sequence 40 permit tcp any host x.12.1.22 eq ssl
sequence 50 permit tcp any host x.12.1.23 eq ssl
sequence 60 permit esp any host x.12.1.24
sequence 70 permit ahp any host x.12.1.24
sequence 80 deny ip any any log
!

2. Check that ACL is applied to alternative gateway interface.
interface ethernet 1/1/10
ip address x.12.1.10 255.255.255.0
ip access-group FILTER_ISP in
!

If the alternative gateway interface is not configured with an ACL permitting only the destination addresses in the sites address space, this is a finding.

Check Content Reference

M

Target Key

5696