STIGQter: STIG Summary: RUCKUS ICX NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

DISA Rule

SV-273825r1110845_rule

Vulnerability Number

V-273825

Group Title

SRG-APP-000395-NDM-000310

Rule Version

RCKS-NDM-000730

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Delete any SNMP users not configured for SHA/AES. Configure SNMP user account for SHA/AES.

SSH@ICX(config)#snmp-server user test_admin test_group v3 auth sha256 [security-string] priv aes [security-key]

Check Contents

View SNMP users:

SSH@ICX# show snmp user

username = admin1
acl name = <none>
group = lab
security model = v3
group acl name = <none>
group ipv6 acl name = <none>
authtype = sha
authkey = 6e3e368283194dffcdabde95c9c44e795de911c2
privtype = aes
privkey = c8b94fccfc1c845ed8a0d7b172405feb
engine ID= 80 0 7c7 3d4c19e609a58

If any users are not configured for authtype sha, this is a finding.

Vulnerability Number

V-273825

Documentable

False

Rule Version

RCKS-NDM-000730

Severity Override Guidance

View SNMP users:

SSH@ICX# show snmp user

username = admin1
acl name = <none>
group = lab
security model = v3
group acl name = <none>
group ipv6 acl name = <none>
authtype = sha
authkey = 6e3e368283194dffcdabde95c9c44e795de911c2
privtype = aes
privkey = c8b94fccfc1c845ed8a0d7b172405feb
engine ID= 80 0 7c7 3d4c19e609a58

If any users are not configured for authtype sha, this is a finding.

Check Content Reference

M

Target Key

5695