STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

DISA Rule

SV-273597r1110916_rule

Vulnerability Number

V-273597

Group Title

SRG-NET-000168-RTR-000078

Rule Version

RCKS-RTR-000300

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure OSPF or BGP keychain as appropriate:

ICX(config)# router ospf
ICX(config-ospf-router)# area 0

ICX(config)# interface ve 1
ICX(config-vif-1)#ip ospf area 0
ICX(config-vif-1)#ip ospf authentication hmac-sha-256 key 10 key my_ospf_pass_key

---------------------

ICX(config)# keychain mykeychain
ICX(config-keychain-tcp-mykeychain)# key 1
ICX(config-keychain-tcp-mykeychain-key-1)# authentication-algorithm aes-128-cmac
ICX(config-keychain-tcp-mykeychain-key-1)# no accept-ao-mismatch
ICX(config-keychain-tcp-mykeychain-key-1)# include-tcp-options
ICX(config-keychain-tcp-mykeychain-key-1)# send-id 1
ICX(config-keychain-tcp-mykeychain-key-1)# recv-id 1
ICX(config-keychain-tcp-mykeychain-key-1)# accept-lifetime start 03-05-24 10:10:10 end 15552000 !!! 180 days in seconds
ICX(config-keychain-tcp-mykeychain-key-1)# send-lifetime start 03-05-24 10:10:10 end 09-01-24 10:10:10

ICX(config)# router bgp
ICX(config-bgp-router)# local-as xxxx
ICX(config-bgp-router)# neighbor x.x.x.x remote-as 10
ICX(config-bgp-router)#neighbor x.x.x.x ao mykeychain

Check Contents

Review configuration for routing protocol authentication and encryption.

OSPF:

router ospf
area 0
!
interface ethernet 1/1/1
ip ospf area 0
ip ospf authentication hmac-sha-256 key-id 10 key 2 $Nlx9cy1TR31TIS0tfURuXA==
ipv6 address fd00:12::2/32
!

BGP:

keychain mykeychain tcp
key-id 1
password 2 $Uyt9R3NVfURuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 1
recv-id 1

router bgp
local-as xxxx
neighbor x.x.x.x remote-as 10
neighbor x.x.x.x ao mykeychain

If OSPF or BGP is configured and does not use authentication/encryption, this is a finding.

Vulnerability Number

V-273597

Documentable

False

Rule Version

RCKS-RTR-000300

Severity Override Guidance

Review configuration for routing protocol authentication and encryption.

OSPF:

router ospf
area 0
!
interface ethernet 1/1/1
ip ospf area 0
ip ospf authentication hmac-sha-256 key-id 10 key 2 $Nlx9cy1TR31TIS0tfURuXA==
ipv6 address fd00:12::2/32
!

BGP:

keychain mykeychain tcp
key-id 1
password 2 $Uyt9R3NVfURuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 1
recv-id 1

router bgp
local-as xxxx
neighbor x.x.x.x remote-as 10
neighbor x.x.x.x ao mykeychain

If OSPF or BGP is configured and does not use authentication/encryption, this is a finding.

Check Content Reference

M

Target Key

5696