The IAO/NSO will ensure VLAN1 is not used for user VLANs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3971	NET-VLAN-004	SV-3971r1_rule	DCCS-1	Medium

Description
In a VLAN-based network, switches use VLAN1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

Description

In a VLAN-based network, switches use VLAN1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. As a consequence, VLAN 1 may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

STIG	Date
Layer 2 Switch Security Technical Implementation Guide - Cisco	2013-10-08

Details

Check Text ( C-4028r1_chk )
Review the switch configurations and verify that no access ports have been assigned membership to the VLAN 1. A good method of ensuring there is not membership to VLAN 1 is to have the following configured: interface VLAN1 no ip address shutdown This technique does not prevent switch control plane protocols such as CDP, DTP, VTP, and PAgP from using VLAN 1. A show vlan 1 command can be used to verify what ports are assigned to VLAN 1.

Check Text ( C-4028r1_chk )

Review the switch configurations and verify that no access ports have been assigned membership to the VLAN 1. A good method of ensuring there is not membership to VLAN 1 is to have the following configured:

interface VLAN1
no ip address
shutdown

This technique does not prevent switch control plane protocols such as CDP, DTP, VTP, and PAgP from using VLAN 1.

A show vlan 1 command can be used to verify what ports are assigned to VLAN 1.

Fix Text (F-3904r1_fix)
Best practices for VLAN-based networks is to prune unnecessary ports from gaining access to VLAN1 as well as the management VLAN, and to separate in-band management, device protocol, and data traffic.