STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

DISA Rule

SV-273601r1110917_rule

Vulnerability Number

V-273601

Group Title

SRG-NET-000193-RTR-000112

Rule Version

RCKS-RTR-000340

Severity

CAT II

CCI(s)

CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

Fix Recommendation

Configure DDoS protection (values may vary):

ICX(config)#ip icmp attack-rate burst-normal 500 burst-max 1000 lockup 300
ICX(config)#ip tcp burst-normal 30 burst-max 100 lockup 300

If required, apply DSCP trust to applicable interfaces:

ICX(config)# interface ethernet x/x/x
ICX(config-if-e1000-x/x/x)# trust dscp

Check Contents

Review configuration to determine whether DDoS attack prevention is configured (values may vary):

ICX#show running-config | include burst
ip icmp attack-rate burst-normal 500 burst-max 1000 lockup 300
ip tcp burst-normal 30 burst-max 100 lockup 300

If DSCP trust is required, verify that it has been applied to the necessary interfaces.

ICX# show running-config interface ethernet x/x/x

interface ethernet x/x/x
trust dscp

If DDoS protection is not configured or DSCP trust is required but not configured, this is a finding.

The RUCKUS ICX PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key