OpenControls Logo

STIG Viewer

STIGViewer Support

The RUCKUS ICX perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-273644RCKS-RTR-000770SV-273644r1110900_ruleCCI-002403low
Description
LLDPs are primarily used to obtain protocol addresses of neighboring devices and discover platform capabilities of those devices. Use of SNMP with the LLDP Management Information Base (MIB) allows network management applications to learn the device type and the SNMP agent address of neighboring devices, thereby enabling the application to send SNMP queries to those devices. LLDPs are also media- and protocol-independent as they run over the data link layer; therefore, two systems that support different network-layer protocols can still learn about each other. Allowing LLDP messages to reach external network nodes is dangerous as it provides an attacker a method to obtain information of the network infrastructure that can be useful to plan an attack.
STIGDate
RUCKUS ICX Router Security Technical Implementation Guide2025-06-03

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-03Boundary Protection
0.50
NET-04.1Deny Traffic by Default & Allow Traffic by Exception
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-6Configuration Settings
1.00
SC-24Fail in Known State
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-7(5)Deny by Default — Allow by Exception
1.00
CCI1 mapping
CCI-002403
1.00

Details

Check Text (C-273644r1110900_chk)

This requirement is not applicable for the DODIN Backbone. Review the global configuration to verify that LLDP has been disabled on external interfaces. (LLDP is enabled on all interfaces by default.) show running-config | include lldp no lldp enable ports ethernet 1/1/1 If LLDP is enabled on perimeter router external interfaces, this is a finding.

Fix Text (F-77640r1109953_fix)

This requirement is not applicable for the DODIN Backbone. Disable LLDP on external interfaces of the perimeter router. ICX(config)# no lldp enable ports ethernet 1/1/x to 1/1/y