Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Cisco switch must have all trunk links enabled statically.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-220666 | CISC-L2-000200 | SV-220666r539671_rule | Medium |
| Description |
|---|
| When trunk negotiation is enabled via Dynamic Trunk Protocol (DTP), considerable time can be spent negotiating trunk settings (802.1q or ISL) when a node or interface is restored. While this negotiation is happening, traffic is dropped because the link is up from a layer 2 perspective. Packet loss can be eliminated by setting the interface statically to trunk mode, thereby avoiding dynamic trunk protocol negotiation and significantly reducing any outage when restoring a failed link or switch. |
| STIG | Date |
|---|---|
| Cisco IOS XE Switch L2S Security Technical Implementation Guide | 2021-09-09 |
Details
| Check Text ( C-22381r507546_chk ) |
|---|
| By default, Dynamic Trunking Protocol (DTP) is enabled on all Cisco switches. Review the switch configuration to verify that trunk links will not form trunk via negotiation as shown in the example below: SW2#show interfaces switchport Name: Gi0/0 Switchport: Enabled Administrative Mode: dynamic auto Operational Mode: static access Administrative Trunking Encapsulation: negotiate Operational Trunking Encapsulation: native Negotiation of Trunking: On If trunk negotiation is enabled on any interface, this is a finding. |
| Fix Text (F-22370r507547_fix) |
|---|
| Configure the switch to enable trunk links statically as shown in the configuration below: SW2(config-if)#switchport trunk encapsulation dot1q SW2(config-if)#switchport mode trunk SW2(config-if)#switchport nonegotiate |