STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.

DISA Rule

SV-273634r1110940_rule

Vulnerability Number

V-273634

Group Title

SRG-NET-000362-RTR-000117

Rule Version

RCKS-RTR-000670

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the router to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks as shown in the example below:

ICX(config)#router bgp
ICX(config-bgp-router)#neighbor x.1.1.9 maximum-prefix nnnnnnn
ICX(config-bgp-router)#neighbor x.2.1.7 maximum-prefix nnnnnnn

Check Contents

Review the router configuration to verify that the number of received prefixes from each eBGP neighbor is controlled.

router bgp
neighbor x.1.1.9 remote-as yy
neighbor x.1.1.9 maximum-prefix nnnnnnn
neighbor x.2.1.7 remote-as zz
neighbor x.2.1.7 maximum-prefix nnnnnnn

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix de-aggregation attacks, this is a finding.

Vulnerability Number

V-273634

Documentable

False

Rule Version

RCKS-RTR-000670

Severity Override Guidance

Review the router configuration to verify that the number of received prefixes from each eBGP neighbor is controlled.

router bgp
neighbor x.1.1.9 remote-as yy
neighbor x.1.1.9 maximum-prefix nnnnnnn
neighbor x.2.1.7 remote-as zz
neighbor x.2.1.7 maximum-prefix nnnnnnn

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix de-aggregation attacks, this is a finding.

Check Content Reference

M

Target Key

5696