Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Cisco switch must have all disabled switch ports assigned to an unused VLAN.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-220690 | CISC-L2-000210 | SV-220690r991946_rule | Medium |
| Description |
|---|
| It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member. |
| STIG | Date |
|---|---|
| Cisco NX OS Switch L2S Security Technical Implementation Guide | 2024-06-06 |
Details
| Check Text ( C-22405r539121_chk ) |
|---|
| Step 1: Review the switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN. interface Ethernet1/81 shutdown switchport access vlan 999 interface Ethernet1/82 shutdown switchport access vlan 999 interface Ethernet1/83 shutdown switchport access vlan 999 Step 2: Verify that traffic from the inactive VLAN is not allowed on any trunk links as shown in the example below: interface Ethernet1/1 switchport mode trunk switchport trunk allowed vlan 1-998,1000-4094 Note: Switch ports configured for 802.1x are exempt from this requirement. If there are any access switch ports not in use and not in an inactive VLAN, this is a finding. |
| Fix Text (F-22394r539122_fix) |
|---|
| Assign all switch ports not in use to an inactive VLAN. Step 1: Assign the disabled interfaces to an inactive VLAN. SW1(config)# int e1/81-128 SW1(config-if-range)# switchport access vlan 999 SW1(config-if-range)# end Step 2: Configure trunk links to not allow traffic from the inactive VLAN. SW1(config-if)# switchport trunk allowed vlan except 999 SW1(config-if)# end |