STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to filter traffic destined to the enclave in accordance with the guidelines contained in DOD Instruction 8551.1.

DISA Rule

SV-273607r1110919_rule

Vulnerability Number

V-273607

Group Title

SRG-NET-000205-RTR-000003

Rule Version

RCKS-RTR-000400

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure the router to use ingress ACLs to restrict traffic in accordance with the guidelines contained in DOD Instruction 8551.1 for all services and protocols required for operational commitments.

1. Create ACLs for external and internal interfaces in accordance with site security policy (addresses and protocols may vary).
ICX(config)#ip access-list ext EXT-ACL
ICX(config-ext-ipacl-EXT-ACL)#permit tcp host x.11.1.1 eq bgp host x.11.1.2
ICX(config-ext-ipacl-EXT-ACL)#permit tcp host x.11.1.1 host x.11.1.2 eq bgp
ICX(config-ext-ipacl-EXT-ACL)#permit icmp host x.11.1.1 host x.11.1.2 echo
ICX(config-ext-ipacl-EXT-ACL)#permit icmp host x.11.1.1 host x.11.1.2 echo-reply
...
(IAW DOD INST 8551.1)
...
ICX(config-ext-ipacl-EXT-ACL)#deny ip host x.11.1.1 host x.11.1.2 log
ICX(config-ext-ipacl-EXT-ACL)#exit

ICX(config)#ip access-list ext INT-ACL
ICX(config-ext-ipacl-INT-ACL)#permit icmp any any
ICX(config-ext-ipacl-INT-ACL)#permit ospf host 10.1.12.1 host 10.1.12.2
ICX(config-ext-ipacl-INT-ACL)#permit tcp 10.2.1.0/24 host 10.1.12.2 eq 22
ICX(config-ext-ipacl-INT-ACL)#permit tcp 10.2.1.0/24 host 10.1.12.2 eq radius
ICX(config-ext-ipacl-INT-ACL)#permit udp 10.2.1.0/24 host 10.1.12.2 eq snmp
ICX(config-ext-ipacl-INT-ACL)#permit udp 10.2.1.0/24 host 10.1.12.2 eq ntp
ICX(config-ext-ipacl-INT-ACL)#deny ip any host 10.1.12.2 log

2. Apply ACLs to appropriate interfaces.
ICX(config)# interface ethernet x/x/x
ICX(config-if-e1000-x/x/x)#ip access-group EXT-ACL in logging enable
ICX(config-if-e1000-x/x/x)# interface ethernet y/y/y
ICX(config-if-e1000-y/y/y)#ip access-group INT-ACL in logging enable

Check Contents

Review the external and internal Access Control Lists (ACLs) to verify the router is configured to filter traffic destined to the enclave in accordance with the guidelines contained in DOD Instruction 8551.1.

If the router does not filter traffic in accordance with the guidelines contained in DOD 8551, this is a finding.

Vulnerability Number

V-273607

Documentable

False

Rule Version

RCKS-RTR-000400

Severity Override Guidance

Review the external and internal Access Control Lists (ACLs) to verify the router is configured to filter traffic destined to the enclave in accordance with the guidelines contained in DOD Instruction 8551.1.

If the router does not filter traffic in accordance with the guidelines contained in DOD 8551, this is a finding.

Check Content Reference

M

Target Key

5696