Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-3973 | NET-VLAN-002 | SV-3973r2_rule | Low |
| Description |
|---|
| It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member. |
| STIG | Date |
|---|---|
| Layer 2 Switch Security Technical Implementation Guide | 2017-12-07 |
Details
| Check Text ( C-4035r3_chk ) |
|---|
| Review the device configuration to determine if all disabled ports have been placed into an unused VLAN. The VLAN must not be VLAN 1. If disabled ports are not assigned to an unused VLAN or have been placed into VLAN 1, this is a finding. |
| Fix Text (F-3906r2_fix) |
|---|
| Assign all disabled ports to an unused VLAN. Do not use VLAN1. |