STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX router must employ organization-defined controls by type of denial of service (DoS) to achieve the DoS objective.

DISA Rule

SV-273669r1111074_rule

Vulnerability Number

V-273669

Group Title

SRG-NET-000705-RTR-000110

Rule Version

RCKS-RTR-001060

Severity

CAT II

CCI(s)

CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

Fix Recommendation

Configure DDoS protection (values may vary):

ICX(config)#ip icmp attack-rate burst-normal 500 burst-max 1000 lockup 300
ICX(config)#ip tcp burst-normal 30 burst-max 100 lockup 300

If required, apply DSCP trust to applicable interfaces:

ICX(config)# interface ethernet x/x/x
ICX(config-if-e1000-x/x/x)# trust dscp

Check Contents

Review configuration to determine whether distributed denial-of-service (DDoS) attack prevention is configured (values may vary):

ICX#show running-config | include burst
ip icmp attack-rate burst-normal 500 burst-max 1000 lockup 300
ip tcp burst-normal 30 burst-max 100 lockup 300

If DSCP trust is required, verify it has been applied to the necessary interfaces.

ICX# show running-config interface ethernet x/x/x

interface ethernet x/x/x
trust dscp

If DDoS protection is not configured or Differentiated Services Code Point (DSCP) trust is required but not configured, this is a finding.

The RUCKUS ICX router must employ organization-defined controls by type of denial of service (DoS) to achieve the DoS objective.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key