STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

DISA Rule

SV-273693r1110996_rule

Vulnerability Number

V-273693

Group Title

SRG-NET-000512-L2S-000012

Rule Version

RCKS-L2S-000260

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

If a trunk port (1/2/1 below) also has the default VLAN assigned as the native VLAN (i.e., untagged), remove that interface from the default VLAN.

device# configure terminal
device(config)# default-vlan-id 4505
device(config)# vlan 4505
device(config-vlan-4505)# no untag ethernet 1/2/1

Check Contents

Examine the ports associated with the default VLAN.

device#show vlans
Total PORT-VLAN entries: 2
Maximum PORT-VLAN entries: 1024

Legend: [Stk=Stack-Id, S=Slot]

PORT-VLAN 4505, Name DEFAULT-VLAN, Priority level0, On
Untagged Ports: (U1/M1)
Untagged Ports: (U1/M1)
Untagged Ports: (U1/M1)
Untagged Ports: (U1/M1)
Untagged Ports: (U1/M2)
Tagged Ports: None
Mac-Vlan Ports: None
Monitoring: Disabled
device#

If any 802.1q trunk interfaces (with tagged VLANs) also have the default VLAN assigned as the native VLAN (i.e., untagged), this is a finding.

The RUCKUS ICX layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key