STIGQter STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

DISA Rule

SV-273604r1110881_rule

Vulnerability Number

V-273604

Group Title

SRG-NET-000202-RTR-000001

Rule Version

RCKS-RTR-000370

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Apply ACL configuration to apply desired traffic restrictions:

ip access-list extended EXT-ACL
sequence 10 permit sshow host x.x.x.x host y.y.y.y log
sequence 20 permit ip x.x.x.0 0.0.0.255 any
sequence 30 deny ip any any log

interface ethernet x/x/x
ip access-group EXT-ACL in logging enable

Check Contents

Confirm that external interfaces are configured with ACLs that permit traffic by exception.

ip access-list extended EXT-ACL
sequence 10 permit sshow host x.x.x.x host y.y.y.y log
sequence 20 permit ip x.x.x.0 0.0.0.255 any
sequence 30 deny ip any any log

interface ethernet x/x/x
ip access-group EXT-ACL in logging enable

If the ACL or filter is not configured to allow specific ports and protocols and deny all other traffic, this is a finding.

If the filter is not configured inbound on all external interfaces, this is a finding.

Vulnerability Number

V-273604

Documentable

False

Rule Version

RCKS-RTR-000370

Severity Override Guidance

Confirm that external interfaces are configured with ACLs that permit traffic by exception.

ip access-list extended EXT-ACL
sequence 10 permit sshow host x.x.x.x host y.y.y.y log
sequence 20 permit ip x.x.x.0 0.0.0.255 any
sequence 30 deny ip any any log

interface ethernet x/x/x
ip access-group EXT-ACL in logging enable

If the ACL or filter is not configured to allow specific ports and protocols and deny all other traffic, this is a finding.

If the filter is not configured inbound on all external interfaces, this is a finding.

Check Content Reference

M

Target Key

5696