STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

DISA Rule

SV-273680r1110983_rule

Vulnerability Number

V-273680

Group Title

SRG-NET-000362-L2S-000024

Rule Version

RCKS-L2S-000120

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure switch to block unknown unicast by port:

1. Global config:
Router# configure terminal

2. Designate port level configuration:
Router(config)# interface ethernet 1/1/1 to 1/1/48

3. Enter command on interface:
Router(config-mif-1/1/1-1/1/48)# block unknown-unicast

4. Save the configuration:
Router# write memory

Check Contents

Review configuration to verify ports are configured to block unknown unicast traffic.

!
interface ethernet 1/1/8
block unknown-unicast
!

If any access switch ports do not have UUFB enabled, this is a finding.

Vulnerability Number

V-273680

Documentable

False

Rule Version

RCKS-L2S-000120

Severity Override Guidance

Review configuration to verify ports are configured to block unknown unicast traffic.

!
interface ethernet 1/1/8
block unknown-unicast
!

If any access switch ports do not have UUFB enabled, this is a finding.

Check Content Reference

M

Target Key

5697