STIGQter: STIG Summary: RUCKUS ICX NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX device must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-273835r1110833_rule

Vulnerability Number

V-273835

Group Title

SRG-APP-000516-NDM-000336

Rule Version

RCKS-NDM-000920

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
• CCI-003627 - Disable accounts when the accounts have expired.
• CCI-003628 - Disable accounts when the accounts are no longer associated to a user.

Weight

10

Fix Recommendation

Configure AAA as needed:

radius-server host x.x.x.x auth-port 1812 acct-port 1813 default key [shared_secret]
radius-server host y.y.y.y auth-port 1812 acct-port 1813 default key [shared_secret]
aaa authentication login default radius local
aaa authorization commands 0 default radius
aaa authorization exec default radius

Check Contents

Verify that AAA authentication and authorization are configured along with RADIUS/TACACS+ servers.

SSH@ICX#show running-config | include (aaa|radius)
aaa authentication dot1x default radius
radius-server host x.x.x.x auth-port 1812 acct-port 1813 default key 2 $VWlkRGkt dot1x mac-auth
radius-server host y.y.y.y auth-port 1812 acct-port 1813 default key 2 $UGlkRGktdG5v dot1x mac-auth
radius-server key 2 $UGlkRGktdG5v
aaa authentication login default radius local
aaa authorization commands 0 default radius
aaa authorization exec default radius

If two central authentication servers are not configured, this is a finding.

Vulnerability Number

V-273835

Documentable

False

Rule Version

RCKS-NDM-000920

Severity Override Guidance

Verify that AAA authentication and authorization are configured along with RADIUS/TACACS+ servers.

SSH@ICX#show running-config | include (aaa|radius)
aaa authentication dot1x default radius
radius-server host x.x.x.x auth-port 1812 acct-port 1813 default key 2 $VWlkRGkt dot1x mac-auth
radius-server host y.y.y.y auth-port 1812 acct-port 1813 default key 2 $UGlkRGktdG5v dot1x mac-auth
radius-server key 2 $UGlkRGktdG5v
aaa authentication login default radius local
aaa authorization commands 0 default radius
aaa authorization exec default radius

If two central authentication servers are not configured, this is a finding.

Check Content Reference

M

Target Key

5695