OpenControls Logo

STIG Viewer

STIGViewer Support

The RUCKUS ICX switch must uniquely identify all network-connected endpoint devices before establishing any connection.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-273673RCKS-L2S-000020SV-273673r1110976_ruleCCI-000778high
Description
Controlling LAN access via 802.1x authentication can assist in preventing a malicious user from connecting an unauthorized PC to a switch port to inject or receive data from the network without detection.
STIGDate
RUCKUS ICX Layer 2 Switch Security Technical Implementation Guide2025-06-03

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AU-10(1)Association of Identities
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(9)Prohibiting The Use of Unauthorized Hardware
1.00
IA-11Re-authentication
1.00
IA-3Device Identification and Authentication
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00
IA-5(1)Password-based Authentication
1.00
SC-20Secure Name/Address Resolution Service (Authoritative Source)
1.00

+5 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.1
1.00
3.5.2
1.00
CCI1 mapping
CCI-000778
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.AA-05
0.50

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-273673r1110976_chk)

Review configuration for RADIUS server configuration, FlexAuth configuration, and applicable port configuration (optional). aaa authentication dot1x default radius radius-server host 192.168.1.24 auth-port 1812 acct-port 1813 default key 2 $UGlkRGktdG5v dot1x mac-auth no-login authentication auth-order mac-auth dot1x auth-default-vlan 100 restricted-vlan 666 re-authentication reauth-timeout 60 auth-fail-action restricted-vlan dot1x enable dot1x enable ethernet 1/1/14 to 1/1/15 dot1x port-control auto ethernet 1/1/14 to 1/1/15 mac-authentication enable mac-authentication enable ethernet 1/1/13 mac-authentication password-format xxxx.xxxx.xxxx mac-authentication dot1x-override mac-authentication dot1x-disable interface ethernet 1/1/14 port-name dot1x-test use-radius-server 192.168.1.24 no inline power ! Note: Port configuration is only necessary when specifying which RADIUS server is to be used. If user ports are not configured to control LAN access via 802.1X, this is a finding.

Fix Text (F-77669r1110041_fix)

Configure 802.1x to authenticate endpoint devices. 1. Configure RADIUS as the authentication method for 802.1x. ICX(config)#radius-server host x.x.x.x auth-port 1812 acct-port 1813 default key xxxxx dot1x mac-auth no-login 2. Configure the dot1x authentication. ICX(config)#authentication ICX(config-authen)# auth-default-vlan 100 ICX(config-authen)# re-authentication ICX(config-authen)# reauth-period 2000 ICX(config-authen)# dot1x enable ICX(config-authen)# dot1x enable ethernet 1/1/14 to 1/1/15 ICX(config-authen)# dot1x max-req 6 ICX(config-authen)# dot1x timeout tx-period 60 ICX(config-authen)# dot1x timeout quiet-period 30