STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

DISA Rule

SV-273622r1110931_rule

Vulnerability Number

V-273622

Group Title

SRG-NET-000230-RTR-000002

Rule Version

RCKS-RTR-000550

Severity

CAT II

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

Configure the router to use unique keys for each AS it peers with as shown in the example below:

ICX(config)# keychain AS-xxxx
ICX(config-keychain-tcp-AS-xxxx)# key 1
ICX(config-keychain-tcp-AS-xxxx-key-1)# authentication-algorithm aes-128-cmac
ICX(config-keychain-tcp-AS-xxxx-key-1)# password pw_for_AS-xxxx
ICX(config-keychain-tcp-AS-xxxx-key-1)# no accept-ao-mismatch
ICX(config-keychain-tcp-AS-xxxx-key-1)# include-tcp-options
ICX(config-keychain-tcp-AS-xxxx-key-1)# send-id 1
ICX(config-keychain-tcp-AS-xxxx-key-1)# recv-id 1
ICX(config-keychain-tcp-AS-xxxx-key-1)# accept-lifetime start 03-05-24 10:10:10 end 15552000
ICX(config-keychain-tcp-AS-xxxx-key-1)# send-lifetime start 03-05-24 10:10:10 end 09-01-24 10:10:10
ICX(config)# keychain AS-yyyy
ICX(config-keychain-tcp-AS-yyyy)# key 1
ICX(config-keychain-tcp-AS-yyyy-key-1)# authentication-algorithm aes-128-cmac
ICX(config-keychain-tcp-AS-yyyy-key-1)# password pw_for_AS-yyyy
ICX(config-keychain-tcp-AS-yyyy-key-1)# no accept-ao-mismatch
ICX(config-keychain-tcp-AS-yyyy-key-1)# include-tcp-options
ICX(config-keychain-tcp-AS-yyyy-key-1)# send-id 2
ICX(config-keychain-tcp-AS-yyyy-key-1)# recv-id 2
ICX(config-keychain-tcp-AS-yyyy-key-1)# accept-lifetime start 03-05-24 10:10:10 end 15552000
ICX(config-keychain-tcp-AS-yyyy-key-1)# send-lifetime start 03-05-24 10:10:10 end 09-01-24 10:10:10

ICX(config)# router bgp
ICX(config-bgp-router)# local-as 1001
ICX(config-bgp-router)# neighbor x.0.0.1 remote-as 10
ICX(config-bgp-router)#neighbor x.0.0.1 ao AS-xxxx
ICX(config-bgp-router)# neighbor y.0.0.1 remote-as 10
ICX(config-bgp-router)#neighbor y.0.0.1 ao AS-yyyy

Check Contents

Review the BGP configuration to determine if it is peering with multiple autonomous systems. Interview the information security systems manager (ISSM) and router administrator to determine if unique keys are being used.

keychain AS-xxxx tcp
key-id 1
password 2 $Uyt9R3NVfURuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 1
recv-id 1

keychain AS-yyyy tcp
key-id 1
password 2 $Uyt9R3123URuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 2
recv-id 2

router bgp
local-as xxxx
neighbor x.0.0.1 remote-as 10
neighbor x.0.0.1 ao AS-xxxx
neighbor y.0.0.1 remote-as 11
neighbor y.0.0.1 as AS-yyyy

If unique keys are not being used, this is a finding.

Vulnerability Number

V-273622

Documentable

False

Rule Version

RCKS-RTR-000550

Severity Override Guidance

Review the BGP configuration to determine if it is peering with multiple autonomous systems. Interview the information security systems manager (ISSM) and router administrator to determine if unique keys are being used.

keychain AS-xxxx tcp
key-id 1
password 2 $Uyt9R3NVfURuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 1
recv-id 1

keychain AS-yyyy tcp
key-id 1
password 2 $Uyt9R3123URuXH1a
authentication-algorithm aes-128-cmac
send-lifetime start 03-05-2024 00:00:00 end 09-01-2024 00:00:00
no accept-ao-mismatch
send-id 2
recv-id 2

router bgp
local-as xxxx
neighbor x.0.0.1 remote-as 10
neighbor x.0.0.1 ao AS-xxxx
neighbor y.0.0.1 remote-as 11
neighbor y.0.0.1 as AS-yyyy

If unique keys are not being used, this is a finding.

Check Content Reference

M

Target Key

5696