STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX PE router must be configured to block any traffic destined to IP core infrastructure.

DISA Rule

SV-273611r1110876_rule

Vulnerability Number

V-273611

Group Title

SRG-NET-000205-RTR-000007

Rule Version

RCKS-RTR-000440

Severity

CAT I

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure protection for the IP core to be implemented at the edges by blocking any traffic with a destination address assigned to the IP core infrastructure.

1. Configure an ingress ACL to discard and log packets destined to the IP core address space.
ICX(config)#ip access-list ext BLOCK_TO_CORE
ICX(config-ext-ipacl-BLOCK_TO_CORE)#deny ip any 10.x.0.0/16 log
ICX(config-ext-ipacl-BLOCK_TO_CORE)#remark permit other traffic
ICX(config-ext-ipacl-BLOCK_TO_CORE)#permit ip any any

2. Apply the ACL inbound to all external or CE-facing interfaces.
ICX(config)#interface ethernet 1/1/1
ICX(config-if-e10000-1/1/1)#port-name CE_port
ICX(config-if-e10000-1/1/1)#ip access-group BLOCK_TO_CORE in logging enable

Check Contents

Review the router configuration to verify an ingress ACL is applied to all CE-facing interfaces and verify the ingress ACL rejects and logs packets destined to the IP core address block.

1. Review the router configuration to verify that an ingress ACL is applied to all external or CE-facing interfaces.
interface ethernet 1/1/1
ip address x.1.1.2/30
ip access-group BLOCK_TO_CORE in logging enable
!

2. Verify the ingress ACL discards and logs packets destined to the IP core address space.
ip access-list extended BLOCK_TO_CORE
sequence 10 deny ip any 10.x.0.0 0.0.255.255 log
remark permit other traffic
sequence 20 permit ip any any
!

If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding.

Vulnerability Number

V-273611

Documentable

False

Rule Version

RCKS-RTR-000440

Severity Override Guidance

Review the router configuration to verify an ingress ACL is applied to all CE-facing interfaces and verify the ingress ACL rejects and logs packets destined to the IP core address block.

1. Review the router configuration to verify that an ingress ACL is applied to all external or CE-facing interfaces.
interface ethernet 1/1/1
ip address x.1.1.2/30
ip access-group BLOCK_TO_CORE in logging enable
!

2. Verify the ingress ACL discards and logs packets destined to the IP core address space.
ip access-list extended BLOCK_TO_CORE
sequence 10 deny ip any 10.x.0.0 0.0.255.255 log
remark permit other traffic
sequence 20 permit ip any any
!

If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding.

Check Content Reference

M

Target Key

5696