STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX BGP Router must be configured to use its loopback address as the source address for internal border gateway protocol (iBGP) peering sessions.

DISA Rule

SV-273654r1111048_rule

Vulnerability Number

V-273654

Group Title

SRG-NET-000512-RTR-000001

Rule Version

RCKS-RTR-000910

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure BGP to use the loopback address as the source address for iBGP peering sessions.

1. Configure a loopback interface.
ICX(config)#interface loop 1
ICX(config-lbif-1)#ip addr x.x.1.1/32

2. Set the loopback interface as the update-source for iBGP peers.
ICX(config)#router bgp
ICX(config-bgp-router)#local-as 10
ICX(config-bgp-router)#neighbor x.x.x.x remote-as 10
ICX(config-bgp-router)#neighbor x.x.x.x update-source loopback 1

Check Contents

Review configuration to verify BGP configuration uses the loopback address as the source address for iBGP peering sessions.

interface loopback 1
ip address x.x.1.1 255.255.255.255
!
router bgp
local-as 10
neighbor x.x.x.x remote-as 10
neighbor x.x.x.x update-source loopback 1

If the router is not using a loopback address as the source for iBGP peering sessions, this is a finding.

Vulnerability Number

V-273654

Documentable

False

Rule Version

RCKS-RTR-000910

Severity Override Guidance

Review configuration to verify BGP configuration uses the loopback address as the source address for iBGP peering sessions.

interface loopback 1
ip address x.x.1.1 255.255.255.255
!
router bgp
local-as 10
neighbor x.x.x.x remote-as 10
neighbor x.x.x.x update-source loopback 1

If the router is not using a loopback address as the source for iBGP peering sessions, this is a finding.

Check Content Reference

M

Target Key

5696