STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Dell OS10 Switch Router Security Technical Implementation Guide

Version

V1R2

Release Date

Mar 4, 2026

SCAP Benchmark ID

Dell_OS10_Switch_Router_STIG

Total Checks

42

Tags

network
CAT I: 2CAT II: 29CAT III: 11

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (42)

V-269849MEDIUMThe Dell OS10 Router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.V-269850MEDIUMThe Dell OS10 BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.V-269851MEDIUMThe Dell OS10 BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).V-269852MEDIUMThe Dell OS10 BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.V-269853MEDIUMThe Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).V-269854LOWThe Dell OS10 BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.V-269855LOWThe Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.V-269857MEDIUMThe Dell OS10 multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.V-269858MEDIUMThe Dell OS10 multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.V-269859LOWThe Dell OS10 Router must be configured to have all inactive interfaces disabled.V-269861HIGHThe perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.V-269863MEDIUMThe Dell OS10 out-of-band management (OOBM) gateway router must be configured to have separate Interior Gateway Protocol (IGP) instances for the managed network and management network.V-269864MEDIUMThe Dell OS10 out-of-band management (OOBM) gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.V-269865LOWThe Dell OS10 multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Register messages received from the Designated Router (DR) for any undesirable multicast groups and sources.V-269866LOWThe Dell OS10 multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.V-269867LOWThe Dell OS10 Router must be configured to log all packets that have been dropped.V-269868MEDIUMThe Dell OS10 Router must be configured to use encryption for routing protocol authentication.V-269869MEDIUMThe Dell OS10 Router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.V-269870MEDIUMThe PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.V-269872HIGHThe Dell OS10 Router must be configured to restrict traffic destined to itself.V-269873MEDIUMThe Dell OS10 Router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.V-269877MEDIUMThe Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.V-269879MEDIUMThe Dell OS10 out-of-band management (OOBM) gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).V-269880MEDIUMThe Dell OS10 out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.V-269882MEDIUMThe Dell OS10 Router must be configured to implement message authentication for all control plane protocols.V-269883MEDIUMThe Dell OS10 BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.V-269884MEDIUMThe Dell OS10 Router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.V-269885MEDIUMThe Dell OS10 Router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.V-269886MEDIUMThe Dell OS10 Router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.V-269887MEDIUMThe Dell OS10 Router must be configured to have Gratuitous ARP disabled on all external interfaces.V-269888LOWThe Dell OS10 Router must be configured to have IP directed broadcast disabled on all interfaces.V-269889MEDIUMThe Dell OS10 Router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.V-269890MEDIUMThe Dell OS10 BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix deaggregation attacks.V-269891LOWThe Dell OS10 BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.V-269892MEDIUMThe Dell OS10 multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.V-269898LOWThe Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join only multicast groups that have been approved by the organization.V-269899MEDIUMThe Dell OS10 multicast Designated Router (DR) must be configured to filter the Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Report messages to allow hosts to join a multicast group only from sources that have been approved by the organization.V-269901LOWThe Dell OS10 BGP router must be configured to use its loopback address as the source address for iBGP peering sessions.V-269902LOWThe Dell OS10 Router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.V-269903MEDIUMThe Dell OS10 Router must not be configured to use IPv6 Site Local Unicast addresses.V-269904MEDIUMThe Dell OS10 Router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.V-269927MEDIUMThe Dell OS10 Router must not be configured to have any feature enabled that calls home to the vendor.