The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18565	NET-NAC-032	SV-20109r1_rule		Low

Description
The Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will disable the port.

STIG	Date
Layer 2 Switch Security Technical Implementation Guide - Cisco	2016-09-28

Details

Check Text ( C-21652r1_chk )
A shutdown action puts the interface into the error-disabled state immediately and sends an SNMP trap notification if it receives a frame with a different layer 2 source address that what has been configured or learned for port security. The following Catalyst IOS interface command will shutdown the interface when such an event occurs: switchport port-security violation shutdown

Fix Text (F-19192r1_fix)
Configure the port to shutdown when insecure hosts are connected to the wall jack.