STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

DISA Rule

SV-273682r1111010_rule

Vulnerability Number

V-273682

Group Title

SRG-NET-000362-L2S-000026

Rule Version

RCKS-L2S-000140

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch to have source-guard enabled on all user-facing or untrusted access switch ports.

1. Interface only:
device# configure terminal
device(config)# interface ethernet 1/1/4
device(config-if-e10000-1/1/4)# source-guard enable

Optional Step 2: Apply to range of interfaces:
device# configure terminal
device(config)# interface ethernet 1/1/1
device(config-if-e10000-1/1/1)# interface ethernet 1/1/21 to 1/1/25
device(config-mif-1/1/21-1/1/25)# source-guard enable

Optional Step 2: Apply to VLAN single port:
device# configure terminal
device(config)# vlan 12
device(config-vlan-12)# untagged ethernet 1/1/5 to 1/1/8
device(config-vlan-12)# tagged ethernet 1/1/23 to 1/1/24
device(config-vlan-12)# source-guard enable ethernet 1/1/23

Optional Step 2: Apply to VLAN all ports:
device# configure terminal
device(config)# vlan 12
device(config-vlan-12)# untagged ethernet 1/1/5 to 1/1/8
device(config-vlan-12)# tagged ethernet 1/1/23 to 1/1/24
device(config-vlan-12)# source-guard enable

Optional Step 2: Apply to VLAN LAG port:
device# configure terminal
device(config)# vlan 12
device(config-vlan-12)# tagged lag 9
device(config-vlan-12)# source-guard enable lag 9

Note: Ports with FlexAuth (802.1X/MAC Auth) will require the keyword "authentication source-guard-protection enable" to apply this feature.

Check Contents

Review the configuration for source-guard enabled on user-facing or untrusted ports.

interface ethernet 1/1/47
port-name FlexAuth_port
authentication source-guard-protection enable
!
interface ethernet 1/1/48
source-guard enable
!

If all user-facing or untrusted switch ports are not configured for IP Source Guard, this is a finding.

Vulnerability Number

V-273682

Documentable

False

Rule Version

RCKS-L2S-000140

Severity Override Guidance

Review the configuration for source-guard enabled on user-facing or untrusted ports.

interface ethernet 1/1/47
port-name FlexAuth_port
authentication source-guard-protection enable
!
interface ethernet 1/1/48
source-guard enable
!

If all user-facing or untrusted switch ports are not configured for IP Source Guard, this is a finding.

Check Content Reference

M

Target Key

5697