STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS DODIN Technical Profile.

DISA Rule

SV-273602r1110894_rule

Vulnerability Number

V-273602

Group Title

SRG-NET-000193-RTR-000113

Rule Version

RCKS-RTR-000350

Severity

CAT III

CCI(s)

CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

Fix Recommendation

Configure DSCP mapping:

ICX(config)# qos-tos map dscp-priority 8 to 0
ICX(config)# qos-tos map dscp-priority 0 1 2 3 4 5 6 7 to 1
ICX(config)# qos-tos map dscp-priority 42 44 50 52 53 54 55 56 to 1
ICX(config)# qos-tos map dscp-priority 57 58 59 60 61 62 63 to 1
ICX(config)# qos-tos map dscp-priority 9 10 11 12 13 14 15 25 to 2
ICX(config)# qos-tos map dscp-priority 26 27 29 31 to 2
ICX(config)# qos-tos map dscp-priority 34 36 38 46 to 3
ICX(config)# qos-tos map dscp-priority 40 41 43 45 47 49 51 to 4
ICX(config)# qos-tos map dscp-priority 48 to 5

Check Contents

Review the QoS-ToS mapping of the PE router. If the DSCP mapping to priority queues does not comply with the GiG Technical Profile, this is a finding.

Vulnerability Number

V-273602

Documentable

False

Rule Version

RCKS-RTR-000350

Severity Override Guidance

Review the QoS-ToS mapping of the PE router. If the DSCP mapping to priority queues does not comply with the GiG Technical Profile, this is a finding.

Check Content Reference

Target Key

5696