STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must not use the default VLAN for management traffic.

DISA Rule

SV-273691r1111060_rule

Vulnerability Number

V-273691

Group Title

SRG-NET-000512-L2S-000010

Rule Version

RCKS-L2S-000240

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure a VLAN specifically for management use:

device(config)# vlan 235 name mgmt-vlan
device(config-vlan-235)# tag ethernet 1/2/1
device(config-vlan-235)# interface ve 235
device(config-vif-235)# ip addr x.x.x.x/x

Note: For L2 images prior to release 10.0, the management VLAN can be configured per the example below. The default-gateway statement sets a metric of 1.

device(config)# vlan 235 name mgmt-vlan
device(config-vlan-235)# tag ethernet 1/2/1
device(config-vlan-235)# management-vlan
device(config-vlan-235)# default-gateway x.x.x.x 1
device(config-vlan-235)# exit
device(config)# ip addr x.x.x.x/x

Check Contents

Review switch configuration to confirm the management VLAN is designated and is not VLAN 1.

!
vlan 235 name mgmt-vlan
tagged ethernet 1/2/1
!

If the management VLAN is the same as the default VLAN or VLAN 1, this is a finding.

Vulnerability Number

V-273691

Documentable

False

Rule Version

RCKS-L2S-000240

Severity Override Guidance

Review switch configuration to confirm the management VLAN is designated and is not VLAN 1.

!
vlan 235 name mgmt-vlan
tagged ethernet 1/2/1
!

If the management VLAN is the same as the default VLAN or VLAN 1, this is a finding.

Check Content Reference

M

Target Key

5697