STIGQter STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must be configured to log all packets that have been dropped.

DISA Rule

SV-273594r1110893_rule

Vulnerability Number

V-273594

Group Title

SRG-NET-000078-RTR-000001

Rule Version

RCKS-RTR-000260

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure ACL deny statements to include "log" and verify logging is enabled where the ACL is applied:

ip access-list extended Block_host_v4
sequence 10 permit ipv6 any any
sequence 20 deny ip host 192.168.10.253 any log
sequence 30 permit ip any any
!
vlan 10 by port
tagged ethernet x/x/x
untagged ethernet y/y/y
ip access-group Block_host_v4 in ethernet 1/3/1 logging enable

Check Contents

Check ACL deny statements for log keywords and that logging is enabled on applicable bindings:

ICX# show ip access Block_host_v4

Extended IP access list Block_host_v4: 3 entries
10: permit ipv6 any any
20: deny ip host 192.168.10.253 any log
30: permit ip any any

ICX# show running-config vlan 10
...
ip access-group Block_host_v4 in ethernet 1/3/1 logging enable

If ACL deny statements lack the log keyword or logging is not enabled in the "ip access-group..." command, this is a finding.

Vulnerability Number

V-273594

Documentable

False

Rule Version

RCKS-RTR-000260

Severity Override Guidance

Check ACL deny statements for log keywords and that logging is enabled on applicable bindings:

ICX# show ip access Block_host_v4

Extended IP access list Block_host_v4: 3 entries
10: permit ipv6 any any
20: deny ip host 192.168.10.253 any log
30: permit ip any any

ICX# show running-config vlan 10
...
ip access-group Block_host_v4 in ethernet 1/3/1 logging enable

If ACL deny statements lack the log keyword or logging is not enabled in the "ip access-group..." command, this is a finding.

Check Content Reference

M

Target Key

5696