STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.

DISA Rule

SV-273623r1110932_rule

Vulnerability Number

V-273623

Group Title

SRG-NET-000230-RTR-000003

Rule Version

RCKS-RTR-000560

Severity

CAT II

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

For each authenticated routing protocol session, configure each key to have a lifetime of no more than 180 days.

ICX(config)# keychain mykeychain
ICX(config-keychain-mykeychain)# key 1
ICX(config-keychain-mykeychain-key-1)# authentication-algorithm hmac-sha-256
ICX(config-keychain-mykeychain-key-1)# password pw_for_mykeychain
ICX(config-keychain-mykeychain-key-1)# send-id 1
ICX(config-keychain-mykeychain-key-1)# recv-id 1
ICX(config-keychain-mykeychain-key-1)# accept-lifetime start 03-05-24 10:10:10 end 15552000
!!! 15552000 seconds = 180 days
ICX(config-keychain-mykeychain-key-1)# send-lifetime start 03-05-24 10:10:10 end 09-01-24 10:10:10

ICX(config-ospf-router)#interface ethernet 1/1/1
ICX(config-vif-12)#ip ospf area 0

ICX(config-vif-12)#ip ospf authentication keychain mykeychain

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the start times for each key within the configured key chains used for routing protocol authentication as shown in the example below:

keychain OSPF_KEY_CHAIN
key-id 1
password xxxxxxx
send-lifetime start 03-05-24 00:00:00 end 09-01-24 00:00:00
accept-lifetime start 03-05-24 00:00:00 end 09-01-24 00:00:00

interface ethernet 1/1/1
ip ospf area 0
ip ospf authentication keychain OSPF_KEY_CHAIN

Note: Keychains must be configured to authenticate routing protocol messages as it is the only way to set an expiration.

If any key has a lifetime of more than 180 days, this is a finding.

Vulnerability Number

V-273623

Documentable

False

Rule Version

RCKS-RTR-000560

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the start times for each key within the configured key chains used for routing protocol authentication as shown in the example below:

keychain OSPF_KEY_CHAIN
key-id 1
password xxxxxxx
send-lifetime start 03-05-24 00:00:00 end 09-01-24 00:00:00
accept-lifetime start 03-05-24 00:00:00 end 09-01-24 00:00:00

interface ethernet 1/1/1
ip ospf area 0
ip ospf authentication keychain OSPF_KEY_CHAIN

Note: Keychains must be configured to authenticate routing protocol messages as it is the only way to set an expiration.

If any key has a lifetime of more than 180 days, this is a finding.

Check Content Reference

M

Target Key

5696