STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS Multicast Source Discovery Protocol (MSDP) router must be configured to authenticate all received MSDP packets.

DISA Rule

SV-273626r1110933_rule

Vulnerability Number

V-273626

Group Title

SRG-NET-000343-RTR-000002

Rule Version

RCKS-RTR-000590

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Configure TCP keychain and apply it to MSDP peer(s):

ICX(config)# keychain mykeychain
ICX(config-keychain-mykeychain)# key 1
ICX(config-keychain-mykeychain-key-1)# authentication-algorithm hmac-sha-256
ICX(config-keychain-mykeychain-key-1)# password pw_for_mykeychain
ICX(config-keychain-mykeychain-key-1)# send-id 1
ICX(config-keychain-mykeychain-key-1)# recv-id 1
ICX(config-keychain-mykeychain-key-1)# accept-lifetime start 03-05-24 10:10:10 end 15552000
ICX(config-keychain-mykeychain-key-1)# send-lifetime start xx-xx-xx xx:xx:xx end xx-xx-xx xx:xx:xx

ICX(config-keychain-mykeychain-key-1)# router msdp

ICX(config-msdp-router)# msdp-peer x.x.x.x connect-source loopback 1 ao mykeychain

Check Contents

Review the running configuration to determine whether MSDP peers are configured for authentication.

ICX(config-msdp-router)# msdp-peer x.x.x.x connect-source loopback 1
ICX(config-msdp-router)# msdp-peer x.x.x.x connect-source loopback 1 ao chain1

If MSDP peers are not configured for authentication, this is a finding.

Vulnerability Number

V-273626

Documentable

False

Rule Version

RCKS-RTR-000590

Severity Override Guidance

Review the running configuration to determine whether MSDP peers are configured for authentication.

ICX(config-msdp-router)# msdp-peer x.x.x.x connect-source loopback 1
ICX(config-msdp-router)# msdp-peer x.x.x.x connect-source loopback 1 ao chain1

If MSDP peers are not configured for authentication, this is a finding.

Check Content Reference

M

Target Key

5696