STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must authenticate all network-connected endpoint devices before establishing any connection.

DISA Rule

SV-273676r1111002_rule

Vulnerability Number

V-273676

Group Title

SRG-NET-000343-L2S-000016

Rule Version

RCKS-L2S-000080

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Configure dot1x:

1. Enter global config mode:
Router#configure terminal

2. Authentication configuration settings:
Router(config)#authentication
Router(config-authen)#auth-default-vlan 600 (user preference)
Router(config-authen)#re-authentication
Router(config-authen)#reauth-period 2000
Router(config-authen)#dot1x enable
Router(config-authen)#dot1x enable ethernet 1/1/14 to 1/1/15
Router(config-authen)#dot1x max-req 6
Router(config-authen)#dot1x timeout tx-period 60
Router(config-authen)#dot1x timeout quiet-period 30
Router(config-authen)#mac-authentication enable
Router(config-authen)#mac-authentication enable ethernet 1/1/18 to 1/1/19

3. Save:
Router#write memory

Check Contents

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication must be configured on those switch ports connected to devices that do not provide an 802.1x supplicant.

show running-config authentication
auth-default-vlan 100
re-authentication
reauth-period 2000
dot1x enable
dot1x enable ethernet 1/1/1 to 1/1/3
dot1x max-req 6
dot1x timeout tx-period 60
dot1x timeout quiet-period 30
mac-authentication enable
mac-authentication enable ethernet 1/1/18 to 1/1/19

If 802.1x authentication or MAC Authentication is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.

Vulnerability Number

V-273676

Documentable

False

Rule Version

RCKS-L2S-000080

Severity Override Guidance

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication must be configured on those switch ports connected to devices that do not provide an 802.1x supplicant.

show running-config authentication
auth-default-vlan 100
re-authentication
reauth-period 2000
dot1x enable
dot1x enable ethernet 1/1/1 to 1/1/3
dot1x max-req 6
dot1x timeout tx-period 60
dot1x timeout quiet-period 30
mac-authentication enable
mac-authentication enable ethernet 1/1/18 to 1/1/19

If 802.1x authentication or MAC Authentication is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.

Check Content Reference

M

Target Key

5697