STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

DISA Rule

SV-273587r1111281_rule

Vulnerability Number

V-273587

Group Title

SRG-NET-000019-RTR-000010

Rule Version

RCKS-RTR-000190

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Create a prefix list to be used by route map to prevent static routes pointing to the alternate gateway service provider from being redistributed:
ip prefix-list ISP_PREFIX permit 10.12.1.0/24

route-map FILTER_ISP_STATIC deny 10
match ip address prefix-list ISP_PREFIX
route-map FILTER_ISP_STATIC permit 20
!

router ospf
redistribute static route-map FILTER_ISP_STATIC
!

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review ICX router configuration for statements redistributing static routes into IGP or BGP:
router bgp
local-as 1001
neighbor x.4.4.4 remote-as 1000
redistribute static
!
router ospf
redistribute static
!

If static routes with the alternate gateway service provider as the next hop exist and static routes are redistributed into an IGP or BGP (without a route-map filter), this is a finding.

Vulnerability Number

V-273587

Documentable

False

Rule Version

RCKS-RTR-000190

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review ICX router configuration for statements redistributing static routes into IGP or BGP:
router bgp
local-as 1001
neighbor x.4.4.4 remote-as 1000
redistribute static
!
router ospf
redistribute static
!

If static routes with the alternate gateway service provider as the next hop exist and static routes are redistributed into an IGP or BGP (without a route-map filter), this is a finding.

Check Content Reference

M

Target Key

5696