The Cisco switch must implement Rapid Spanning Tree Protocol (STP) where VLANs span multiple switches with redundant links.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-101143	CISC-L2-000180	SV-110247r1_rule		Medium

Description
STP is implemented on bridges and switches to prevent Layer 2 loops when a broadcast domain spans multiple bridges and switches and when redundant links are provisioned to provide high availability in case of link failures. Convergence time can be significantly reduced using Rapid STP (802.1w) instead of STP (802.1d), resulting in improved availability. Rapid STP should be deployed by implementing either Rapid Per-VLAN-Spanning-Tree (Rapid-PVST) or Multiple Spanning-Tree Protocol (MSTP). The latter scales much better when there are many VLANs.

Description

STP is implemented on bridges and switches to prevent Layer 2 loops when a broadcast domain spans multiple bridges and switches and when redundant links are provisioned to provide high availability in case of link failures. Convergence time can be significantly reduced using Rapid STP (802.1w) instead of STP (802.1d), resulting in improved availability. Rapid STP should be deployed by implementing either Rapid Per-VLAN-Spanning-Tree (Rapid-PVST) or Multiple Spanning-Tree Protocol (MSTP). The latter scales much better when there are many VLANs.

STIG	Date
Cisco IOS Switch L2S Security Technical Implementation Guide	2020-05-07

Details

Check Text ( C-100023r1_chk )
In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the switch configuration to verify that Rapid STP has been implemented: hostname SW2 … … … spanning-tree mode rapid-pvst Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs. If either RSTP or MSTP has not been implemented where STP is required, this is a finding.

Check Text ( C-100023r1_chk )

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the switch configuration to verify that Rapid STP has been implemented:

hostname SW2
…
…
…
spanning-tree mode rapid-pvst

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs.

If either RSTP or MSTP has not been implemented where STP is required, this is a finding.

Fix Text (F-106847r1_fix)
Configure Rapid STP or MSTP to be implemented at the access and distribution layers where VLANs span multiple switches as shown in the examples below: SW2(config)#spanning-tree mode rapid-pvst or SW1(config)#spanning-tree mode mst