UCF STIG Viewer Logo

Layer 2 Switch Security Technical Implementation Guide



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-4582 High The network device must require authentication for console access.
V-5626 High The switch must be configured to use 802.1x authentication on host facing access switch ports.
V-3056 High Group accounts must not be configured for use on the network device.
V-15434 High The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
V-3012 High Network devices must be password protected.
V-3062 High Network devices must be configured to ensure passwords are not viewable when displaying configuration information.
V-3143 High Network devices must not have any default manufacturer passwords.
V-3210 High The network device must not use the default or well-known SNMP community strings public and private.
V-3175 High The network device must require authentication prior to establishing a management connection for administrative access.
V-3196 High The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
V-3085 Medium Network devices must have HTTP service for administrative access disabled.
V-3069 Medium Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
V-14671 Medium Network devices must authenticate all NTP messages received from NTP servers and peers.
V-3043 Medium The network device must use different SNMP community names or groups for various levels of read and write access.
V-14717 Medium The network device must not allow SSH Version 1 to be used for administrative access.
V-3971 Medium VLAN 1 must not be used for user VLANs.
V-17832 Medium The management VLAN must be configured with an IP address from the management network address block.
V-5613 Medium The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
V-3057 Medium Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
V-3160 Medium Network devices must be running a current and supported operating system with all IAVMs addressed.
V-15432 Medium Network devices must use two or more authentication servers for the purpose of granting administrative access.
V-3013 Medium Network devices must display the DoD-approved logon banner warning.
V-3058 Medium Unauthorized accounts must not be configured for access to the network device.
V-14669 Medium Network devices must have BSDr commands disabled.
V-28784 Medium A service or feature that calls home to the vendor must be disabled.
V-5611 Medium The network devices must only allow management connections for administrative access from hosts residing in the management network.
V-5628 Medium A dedicated management VLAN or VLANs must be configured to keep management traffic separate from user data and control plane traffic.
V-3969 Medium Network devices must only allow SNMP read-only access.
V-5622 Medium The native VLAN must be assigned to a VLAN ID other than the default VLAN for all 802.1q trunk links.
V-3966 Medium In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.
V-17824 Medium The management interface is an access switchport and has not been assigned to a separate management VLAN.
V-17826 Medium The access switchport connecting to the OOBM access switch is not the only port with membership to the management VLAN.
V-17820 Medium The OOBM access switch is not physically connected to the managed network element OOBM interface.
V-17821 Medium The network devices OOBM interface must be configured with an OOBM network address.
V-18566 Medium The switch must only allow a maximum of one registered MAC address per access port.
V-5623 Medium Port trunking must be disabled on all access ports (do not configure trunk on, desirable, non-negotiate, or auto--only off).
V-3984 Medium Access switchports must not be assigned to the native VLAN.
V-3021 Medium Network devices must only allow SNMP access from addresses belonging to the management network.
V-3967 Medium The network devices must time out access to the console port at 10 minutes or less of inactivity.
V-5612 Medium The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
V-3014 Medium The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity.
V-3972 Low VLAN 1 must be pruned from all trunk and access ports that do not require it.
V-3973 Low Disabled switch ports must be placed in an unused VLAN (do not use VLAN1).
V-4584 Low The network device must log all messages except debugging and send all log data to a syslog server.
V-23747 Low Network devices must use at least two NTP servers to synchronize time.
V-3079 Low Network devices must have the Finger service disabled.
V-17825 Low An address has not been configured for the management VLAN from space belonging to the OOBM network assigned to that site.
V-17827 Low The management VLAN is not pruned from any VLAN trunk links belonging to the managed network’s infrastructure.
V-3072 Low The running configuration must be synchronized with the startup configuration after changes have been made and implemented.
V-18544 Low Printers must be assigned to a VLAN that is not shared by unlike devices.
V-3020 Low Network devices must have DNS servers defined if it is configured as a client resolver.
V-7011 Low The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
V-3070 Low Network devices must log all attempts to establish a management connection for administrative access.