STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must be configured to only permit management traffic that ingresses and egresses the OOBM interface.

DISA Rule

SV-273616r1110927_rule

Vulnerability Number

V-273616

Group Title

SRG-NET-000205-RTR-000012

Rule Version

RCKS-RTR-000490

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure the OOBM interface with both an ingress and egress ACL.

1. Configure an ingress ACL a shown in the example below:
ICX(config)#ip access-list ext INGRESS_MGMT_ACL
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#permit tcp any host 10.11.1.22 eq radius
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#permit tcp any host 10.11.1.22 eq ssh
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#permit tcp any host 10.11.1.22 eq snmp
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#permit udp any host 10.11.1.22 eq ntp
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#permit icmp any host 10.11.1.22
ICX(config-ext-ipacl-INGRESS_MGMT_ACL)#deny ip any any log

2. Configure an egress ACL a shown in the example below:
ICX(config)#enable egress-acl-on-cpu-traffic
ICX(config)#ip access-list ext EGRESS_MGMT_ACL
ICX(config-ext-ipacl-EGRESS_MGMT_ACL)#permit ip host 10.11.1.22 any
ICX(config-ext-ipacl-EGRESS_MGMT_ACL)#deny ip any any log

3. Apply the ACLs to the OOBM interfaces.
ICX(config-ext-ipacl-EGRESS_MGMT_ACL)#interface ethernet 1/2/1
ICX(config-if-e10000-1/2/1)#port-name Link_to_OOBM_ACCESS_SW
ICX(config-if-e10000-1/2/1)#ip addr 10.11.1.22/24
ICX(config-if-e10000-1/2/1)#ip access-group INGRESS_MGMT_ACL in logging enable
ICX(config-if-e10000-1/2/1)#ip access-group EGRESS_MGMT_ACL out logging enable

Check Contents

Verify the OOBM interface does not forward transit traffic.

1. Verify the managed interface has an inbound and outbound ACL configured.
2. Verify the ingress filter only allows management, IGP, and ICMP traffic.

Note: If the management interface is a true OOBM interface, this requirement is not applicable.

If the router does not restrict traffic that ingresses and egresses the management interface, this is a finding.

Vulnerability Number

V-273616

Documentable

False

Rule Version

RCKS-RTR-000490

Severity Override Guidance

Verify the OOBM interface does not forward transit traffic.

1. Verify the managed interface has an inbound and outbound ACL configured.
2. Verify the ingress filter only allows management, IGP, and ICMP traffic.

Note: If the management interface is a true OOBM interface, this requirement is not applicable.

If the router does not restrict traffic that ingresses and egresses the management interface, this is a finding.

Check Content Reference

M

Target Key

5696