STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).

DISA Rule

SV-273641r1111068_rule

Vulnerability Number

V-273641

Group Title

SRG-NET-000362-RTR-000124

Rule Version

RCKS-RTR-000740

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure TTL security on all external BGP neighbors as shown in the example below:

ICX(config)#router bgp
ICX(config-bgp-router)#neighbor x.1.1.9 remote-as yy
ICX(config-bgp-router)#neighbor x.1.1.9 ebgp-btsh

Check Contents

Review the BGP configuration to verify that TTL security has been configured for each external neighbor as shown in the example below:

router bgp
neighbor x.1.1.9 remote-as yy
neighbor x.1.1.9 ebgp-btsh

If the router is not configured to use TTL security hack protection for all Exterior Border Gateway Protocol peering sessions, this is a finding.

Vulnerability Number

V-273641

Documentable

False

Rule Version

RCKS-RTR-000740

Severity Override Guidance

Review the BGP configuration to verify that TTL security has been configured for each external neighbor as shown in the example below:

router bgp
neighbor x.1.1.9 remote-as yy
neighbor x.1.1.9 ebgp-btsh

If the router is not configured to use TTL security hack protection for all Exterior Border Gateway Protocol peering sessions, this is a finding.

Check Content Reference

M

Target Key

5696