STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-273675r1111323_rule

Vulnerability Number

V-273675

Group Title

SRG-NET-000193-L2S-000020

Rule Version

RCKS-L2S-000040

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure router for DoS:

1. Global config mode:
Router# configure terminal

2. Apply configuration parameters:
Route (config)#ip icmp attack-rate burst-normal 5000 burst-max 10000 lockup 300

3. Apply configuration parameters:
Route (config)#ip tcp burst-normal 30 burst-max 100 lockup 300 

4. Save:
write memory

Check Contents

Review the switch configuration to verify QoS has been enabled to ensure that sufficient capacity is available for mission-critical traffic.

Router# show running-config | include burst
ip icmp attack-rate burst-normal 5000 burst-max 10000 lockup 300
ip tcp burst-normal 30 burst-max 100 lockup 300

If the switch is not configured to manage excess bandwidth to limit the effects of packet flooding types of DoS attacks, this is a finding.

Vulnerability Number

V-273675

Documentable

False

Rule Version

RCKS-L2S-000040

Severity Override Guidance

Review the switch configuration to verify QoS has been enabled to ensure that sufficient capacity is available for mission-critical traffic.

Router# show running-config | include burst
ip icmp attack-rate burst-normal 5000 burst-max 10000 lockup 300
ip tcp burst-normal 30 burst-max 100 lockup 300

If the switch is not configured to manage excess bandwidth to limit the effects of packet flooding types of DoS attacks, this is a finding.

Check Content Reference

M

Target Key

5697