STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX perimeter router must be configured to drop IPv6 packets containing a hop-by-hop and destination options header with invalid or undefined option type values.

DISA Rule

SV-273652r1111072_rule

Vulnerability Number

V-273652

Group Title

SRG-NET-000364-RTR-000202

Rule Version

RCKS-RTR-000850

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the router to drop IPv6 packets containing a hop-by-hop header with option type values of 0x04 (Tunnel Encapsulation Limit), 0xC9 (Home Address Destination), or 0xC3 (NSAP Address).

1. Create an ACL to drop IPv6 packets with hop-by-hop or Destination Options extension headers.
ICX(config)#ipv6 access BLOCK_OPTIONS
ICX(config-ipv6acl-BLOCK_OPTIONS)#deny 0 any any log
ICX(config-ipv6acl-BLOCK_OPTIONS)#deny 60 any any log
ICX(config-ipv6acl-BLOCK_OPTIONS)#permit ipv6 any any

2. Apply the ACL to external interfaces of the perimeter router.
ICX(config)#interface ethernet x/x/x
ICX(config-if-e1000-x/x/x)#ipv6 access-group BLOCK_OPTIONS in logging enable

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the perimeter router configuration to determine whether an ACL is configured to drop IPv6 packets containing hop-by-hop or destination options extension headers.

1. Review the perimeter router configuration to determine whether an ACL is configured to drop IPv6 packets containing hop-by-hop or destination options extension headers.
ipv6 access-list BLOCK_OPTIONS
sequence 10 deny 0 any any log
sequence 20 deny 60 any any log
sequence 30 permit ipv6 any any
!

2. Verify the ACL has been applied to external interfaces.
interface ethernet x/x/x
ipv6 address x::x/x
ipv6 access-group BLOCK_OPTIONS in logging enable

If the perimeter router is not configured to drop IPv6 packets with hop-by-hop or destination options extension headers, this is a finding.

Vulnerability Number

V-273652

Documentable

False

Rule Version

RCKS-RTR-000850

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the perimeter router configuration to determine whether an ACL is configured to drop IPv6 packets containing hop-by-hop or destination options extension headers.

1. Review the perimeter router configuration to determine whether an ACL is configured to drop IPv6 packets containing hop-by-hop or destination options extension headers.
ipv6 access-list BLOCK_OPTIONS
sequence 10 deny 0 any any log
sequence 20 deny 60 any any log
sequence 30 permit ipv6 any any
!

2. Verify the ACL has been applied to external interfaces.
interface ethernet x/x/x
ipv6 address x::x/x
ipv6 access-group BLOCK_OPTIONS in logging enable

If the perimeter router is not configured to drop IPv6 packets with hop-by-hop or destination options extension headers, this is a finding.

Check Content Reference

M

Target Key

5696