STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

DISA Rule

SV-273618r1111065_rule

Vulnerability Number

V-273618

Group Title

SRG-NET-000205-RTR-000014

Rule Version

RCKS-RTR-000510

Severity

CAT I

CCI(s)

CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the router to ensure an egress ACL or uRPF is configured on internal interfaces to restrict the router from accepting any outbound IP packet that contains an illegitimate address in the source field.

uRPF:

ICX(config)#reverse-path-check
ICX(config)#interface ethernet 1/2/2
ICX(config-if-e10000-1/2/2)#rpf-mode loose

ACL:

ICX(config)#ip access ext EGRESS_FILTER
ICX(config-ext-ipacl-EGRESS_FILTER)#permit udp 10.1.15.0/24 any eq dns
ICX(config-ext-ipacl-EGRESS_FILTER)#permit tcp 10.1.15.0/24 any eq ftp
ICX(config-ext-ipacl-EGRESS_FILTER)#permit tcp 10.1.15.0/24 any eq ftp-data
ICX(config-ext-ipacl-EGRESS_FILTER)#permit tcp 10.1.15.0/24 any eq http
ICX(config-ext-ipacl-EGRESS_FILTER)#permit tcp 10.1.15.0/24 any eq http
ICX(config-ext-ipacl-EGRESS_FILTER)#permit tcp 10.1.15.0/24 any eq ssl
ICX(config-ext-ipacl-EGRESS_FILTER)#permit icmp 10.1.15.0/24 any
ICX(config-ext-ipacl-EGRESS_FILTER)#permit icmp 10.1.15.0/24 any echo
ICX(config-ext-ipacl-EGRESS_FILTER)#deny ip any any
ICX(config)#interface ethernet 1/2/2
ICX(config-if-e10000-1/2/2)#port-name downstream_link_to_LAN
ICX(config-if-e10000-1/2/2)#ip addr 10.1.25.5/24
ICX(config-if-e10000-1/2/2)#ip access-group EGRESS_FILTER in logging enable

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify uRPF or an egress ACL has been configured on all internal interfaces to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field.

uRPF example:

reverse-path-check
!
interface ethernet 1/1/1
port-name downstream_link_to_LAN
ip address 10.1.25.5 255.255.255.0
rpf-mode loose

Egress ACL example:

interface ethernet 1/2/2
port-name downstream_link_to_LAN
ip address 10.1.25.5 255.255.255.0
ip access-group EGRESS_FILTER in logging enable
!
…
…
…
ip access-list extended EGRESS_FILTER
sequence 10 permit udp 10.1.15.0 0.0.0.255 any eq dns
sequence 20 permit tcp 10.1.15.0 0.0.0.255 any eq ftp
sequence 30 permit tcp 10.1.15.0 0.0.0.255 any eq ftp-data
sequence 40 permit tcp 10.1.15.0 0.0.0.255 any eq http
sequence 50 permit tcp 10.1.15.0 0.0.0.255 any eq ssl
sequence 60 permit icmp 10.1.15.0 0.0.0.255 any
sequence 70 permit icmp 10.1.15.0 0.0.0.255 any echo
sequence 80 deny ip any any
!

If uRPF or an egress ACL to restrict the router from accepting outbound IP packets that contain an illegitimate address in the source address field has not been configured on all internal interfaces in an enclave, this is a finding.

The RUCKUS ICX perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key