STIGQter: STIG Summary: RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

DISA Rule

SV-273696r1110998_rule

Vulnerability Number

V-273696

Group Title

SRG-NET-000715-L2S-000120

Rule Version

RCKS-L2S-000300

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Configure the layer 2 switch to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

1. Add appropriate VLAN by name.
device# configure terminal
Router(config)#vlan 5 Name Organization_A
Router(config)#vlan 10 Name Organization_B
Router(config)#vlan 10 Name IP_Phone

2. Add untagged Ports for the specific ports to the VLANs as needed.
Router(config-vlan-5)#untag ethernet 1/1/2

3. Add tagged ports.
Router(config-vlan-5)#tag ethernet 1/1/4

4. Save the configuration.
Router(config-vlan-5)#write memory

Check Contents

Review the RUCKUS ICX switch configuration.

Router# Show Vlans
PORT-VLAN 5, Name Organization_A, Priority level0, in single spanning tree domain
Untagged Ports: None 2
Tagged Ports: (U1/M1) 4 6 8 10 12 14
Mac-Vlan Ports: None
Monitoring: Disabled
PORT-VLAN 10, Name Organization_B, Priority level0, in single spanning tree domain
Untagged Ports: None 20 21 22
Tagged Ports: (U1/M1) 1 3 5 7 9 11
Mac-Vlan Ports: None
Monitoring: Disabled
PORT-VLAN 12, Name IP_Phone, Priority level0, in single spanning tree domain
Untagged Ports: None
Tagged Ports: (U1/M1) 30 31 32 33 34 35
Mac-Vlan Ports: None
Monitoring: Disabled

If the RUCKUS ICX switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Vulnerability Number

V-273696

Documentable

False

Rule Version

RCKS-L2S-000300

Severity Override Guidance

Review the RUCKUS ICX switch configuration.

Router# Show Vlans
PORT-VLAN 5, Name Organization_A, Priority level0, in single spanning tree domain
Untagged Ports: None 2
Tagged Ports: (U1/M1) 4 6 8 10 12 14
Mac-Vlan Ports: None
Monitoring: Disabled
PORT-VLAN 10, Name Organization_B, Priority level0, in single spanning tree domain
Untagged Ports: None 20 21 22
Tagged Ports: (U1/M1) 1 3 5 7 9 11
Mac-Vlan Ports: None
Monitoring: Disabled
PORT-VLAN 12, Name IP_Phone, Priority level0, in single spanning tree domain
Untagged Ports: None
Tagged Ports: (U1/M1) 30 31 32 33 34 35
Mac-Vlan Ports: None
Monitoring: Disabled

If the RUCKUS ICX switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Check Content Reference

M

Target Key

5697