STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must have the default VLAN pruned from all trunk ports that do not require it.

DISA Rule

SV-273690r1110993_rule

Vulnerability Number

V-273690

Group Title

SRG-NET-000512-L2S-000009

Rule Version

RCKS-L2S-000230

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Prune unnecessary trunk links from access to the default VLAN.

1. Review the default VLAN ports.
device#show vlan 888
PORT-VLAN 888, Name DEFAULT-VLAN, Priority level0, On
Untagged Ports: (U1/M1) 1 2 3 4 5 6 7 8 9 10 11 12
Untagged Ports: (U1/M1) 13 14 15 16 17 18 19 20 21 22 23 24
Untagged Ports: (U1/M1) 25 26 27 28 29 30 31 32 33 34 35 36
Untagged Ports: (U1/M1) 37 38 39 40 41 43 44 45 46 47 48
Untagged Ports: (U1/M2) 1 2 3 4 5 6 7 8

2. Remove any trunk ports (example 1/2/1 below) on the list.
device(config-vlan-888)# no untag ethernet 1/2/1

Check Contents

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

device#show vlan 888
PORT-VLAN 888, Name DEFAULT-VLAN, Priority level0, On
Untagged Ports: (U1/M1) 1 2 3 4 5 6 7 8 9 10 11 12
Untagged Ports: (U1/M1) 13 14 15 16 17 18 19 20 21 22 23 24
Untagged Ports: (U1/M1) 25 26 27 28 29 30 31 32 33 34 35 36
Untagged Ports: (U1/M1) 37 38 39 40 41 43 44 45 46 47 48
Untagged Ports: (U1/M2) 1 2 3 4 5 6 7 8
Tagged Ports: None
Mac-Vlan Ports: None
Monitoring: Disabled
device#

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Vulnerability Number

V-273690

Documentable

False

Rule Version

RCKS-L2S-000230

Severity Override Guidance

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

device#show vlan 888
PORT-VLAN 888, Name DEFAULT-VLAN, Priority level0, On
Untagged Ports: (U1/M1) 1 2 3 4 5 6 7 8 9 10 11 12
Untagged Ports: (U1/M1) 13 14 15 16 17 18 19 20 21 22 23 24
Untagged Ports: (U1/M1) 25 26 27 28 29 30 31 32 33 34 35 36
Untagged Ports: (U1/M1) 37 38 39 40 41 43 44 45 46 47 48
Untagged Ports: (U1/M2) 1 2 3 4 5 6 7 8
Tagged Ports: None
Mac-Vlan Ports: None
Monitoring: Disabled
device#

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Check Content Reference

M

Target Key

5697