STIGQter STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must have Spanning Tree Protocol (STP) Loop Detect enabled on all nondesignated STP switch ports

DISA Rule

SV-273679r1110982_rule

Vulnerability Number

V-273679

Group Title

SRG-NET-000362-L2S-000023

Rule Version

RCKS-L2S-000110

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the switch to have STP Loop Detect enabled globally or at a minimum on all nondesignated STP switch ports.

1. Configure loop detect.
ICX7150-24P Switch#configure terminal
ICX7150-24P Switch(config)#vlan 10
ICX7150-24P Switch(config-vlan-10)#
ICX7150-24P Switch(config-vlan-10)#loop-detection

2. Save.
Router#write memory

Optional by Port Level:
Optionally Apply on Interface:
device(config)# interface ethernet 1/1/1
device(config-if-e1000-1/1/1)# loop-detection

Check Contents

Review the switch configuration to verify that STP Loop Detect is enabled.

Verify:
ICX7150-24P Switch#show run
!
vlan 10 by port
tagged ethernet 1/1/1 to 1/1/2 ethernet 1/1/5 ethernet 1/1/7 ethernet 1/1/9 ethernet 1/1/11
spanning-tree
loop-detection
!

If STP Loop Detect is not configured globally or on nondesignated STP ports, this is a finding.

Vulnerability Number

V-273679

Documentable

False

Rule Version

RCKS-L2S-000110

Severity Override Guidance

Review the switch configuration to verify that STP Loop Detect is enabled.

Verify:
ICX7150-24P Switch#show run
!
vlan 10 by port
tagged ethernet 1/1/1 to 1/1/2 ethernet 1/1/5 ethernet 1/1/7 ethernet 1/1/9 ethernet 1/1/11
spanning-tree
loop-detection
!

If STP Loop Detect is not configured globally or on nondesignated STP ports, this is a finding.

Check Content Reference

M

Target Key

5697