STIGQter STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to block inbound packets with source Bogon IP address prefixes.

DISA Rule

SV-273643r1111037_rule

Vulnerability Number

V-273643

Group Title

SRG-NET-000364-RTR-000110

Rule Version

RCKS-RTR-000760

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Review the configuration to verify the command below is not present:

1. Configure an ACL containing the current Bogon prefixes as shown below:
ICX(config)#ip access-list ext FILTER_PERIMETER
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 0.0.0.0/8 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 10.0.0.0/8 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 100.64.0.0/10 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 127.0.0.0/8 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 169.254.0.0/16 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 172.16.0.0/12 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 192.0.0.0/24 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 192.0.2.0/24 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 192.168.0.0/16 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 192.18.0.0/15 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 192.51.100.0/24 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 203.0.113.0/24 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip 224.0.0.0/3 any log
ICX(config-ext-ipacl-FILTER_PERIMETER)#permit tcp any any established
ICX(config-ext-ipacl-FILTER_PERIMETER)#permit tcp host x.0.1.2 host x.0.1.1 eq bgp
ICX(config-ext-ipacl-FILTER_PERIMETER)#permit tcp host x.0.1.1 eq bgp host x.0.1.2
ICX(config-ext-ipacl-FILTER_PERIMETER)#permit icmp host x.0.1.2 host x.0.1.1 echo
ICX(config-ext-ipacl-FILTER_PERIMETER)#permit icmp host x.0.1.1 host x.0.1.2 echo-reply
ICX(config-ext-ipacl-FILTER_PERIMETER)#deny ip any any log

2. Apply the ACL inbound on all external interfaces.
ICX(config)#interface ethernet x/x/x
ICX(config-if-e10000-x/x/x)#ip access-group FILTER_PERIMETER in logging enable

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that an ingress Access Control List (ACL) applied to all external interfaces is blocking packets with Bogon source addresses.

1. Verify an ACL has been configured containing the current Bogon prefixes as shown in the example below:
ip access-list extended FILTER_PERIMETER
sequence 10 deny ip 0.0.0.0 0.255.255.255 any log
sequence 20 deny ip 10.0.0.0 0.255.255.255 any log
sequence 30 deny ip 100.64.0.0 0.63.255.255 any log
sequence 40 deny ip 127.0.0.0 0.255.255.255 any log
sequence 50 deny ip 169.254.0.0 0.0.255.255 any log
sequence 60 deny ip 172.16.0.0 0.15.255.255 any log
sequence 70 deny ip 192.0.0.0 0.0.0.255 any log
sequence 80 deny ip 192.0.2.0 0.0.0.255 any log
sequence 90 deny ip 192.168.0.0 0.0.255.255 any log
sequence 100 deny ip 192.18.0.0 0.1.255.255 any log
sequence 110 deny ip 192.51.100.0 0.0.0.255 any log
sequence 120 deny ip 203.0.113.0 0.0.0.255 any log
sequence 130 deny ip 224.0.0.0 31.255.255.255 any log
sequence 140 permit tcp any any established
sequence 150 permit tcp host x.0.1.2 host x.0.1.1 eq bgp
sequence 160 permit tcp host x.0.1.1 eq bgp host x.0.1.2
sequence 170 permit icmp host x.0.1.2 host x.0.1.1 echo
sequence 180 permit icmp host x.0.1.1 host x.0.1.2 echo-reply
...
sequence 190 deny ip any any log

2. Verify the inbound ACL applied to all external interfaces will block all traffic from Bogon source addresses.
interface ethernet 1/1/1
port-name link_to_DISN
ip access-group FILTER_PERIMETER in logging enable
!

If the router is not configured to block inbound packets with source Bogon IP address prefixes, this is a finding.

Vulnerability Number

V-273643

Documentable

False

Rule Version

RCKS-RTR-000760

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that an ingress Access Control List (ACL) applied to all external interfaces is blocking packets with Bogon source addresses.

1. Verify an ACL has been configured containing the current Bogon prefixes as shown in the example below:
ip access-list extended FILTER_PERIMETER
sequence 10 deny ip 0.0.0.0 0.255.255.255 any log
sequence 20 deny ip 10.0.0.0 0.255.255.255 any log
sequence 30 deny ip 100.64.0.0 0.63.255.255 any log
sequence 40 deny ip 127.0.0.0 0.255.255.255 any log
sequence 50 deny ip 169.254.0.0 0.0.255.255 any log
sequence 60 deny ip 172.16.0.0 0.15.255.255 any log
sequence 70 deny ip 192.0.0.0 0.0.0.255 any log
sequence 80 deny ip 192.0.2.0 0.0.0.255 any log
sequence 90 deny ip 192.168.0.0 0.0.255.255 any log
sequence 100 deny ip 192.18.0.0 0.1.255.255 any log
sequence 110 deny ip 192.51.100.0 0.0.0.255 any log
sequence 120 deny ip 203.0.113.0 0.0.0.255 any log
sequence 130 deny ip 224.0.0.0 31.255.255.255 any log
sequence 140 permit tcp any any established
sequence 150 permit tcp host x.0.1.2 host x.0.1.1 eq bgp
sequence 160 permit tcp host x.0.1.1 eq bgp host x.0.1.2
sequence 170 permit icmp host x.0.1.2 host x.0.1.1 echo
sequence 180 permit icmp host x.0.1.1 host x.0.1.2 echo-reply
...
sequence 190 deny ip any any log

2. Verify the inbound ACL applied to all external interfaces will block all traffic from Bogon source addresses.
interface ethernet 1/1/1
port-name link_to_DISN
ip access-group FILTER_PERIMETER in logging enable
!

If the router is not configured to block inbound packets with source Bogon IP address prefixes, this is a finding.

Check Content Reference

M

Target Key

5696