VLAN Trunk Protocol (VTP) messages must be authenticated with a hash function using the most secured cryptographic algorithm available.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66359	NET2003	SV-80849r1_rule		Medium

Description
VLAN Trunk Protocol (VTP) provides central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed, that is, there are no access switch ports in neighboring switches belonging to such VLANs. An attack can force a digest change for the VTP domain enabling a rogue device to become the VTP server, which could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain's being compromised.

Description

VLAN Trunk Protocol (VTP) provides central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed, that is, there are no access switch ports in neighboring switches belonging to such VLANs. An attack can force a digest change for the VTP domain enabling a rogue device to become the VTP server, which could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain's being compromised.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2016-12-22

Details

Check Text ( C-67005r1_chk )
Review the switch configuration to verify that VTP clients and servers are authenticating messages as shown in the following configuration example: vtp mode server vtp version 2 vtp domain ICAN1 vtp password xxxxxxxx If any switches within the ICAN infrastructure have implemented VTP and are not authenticating VTP messages with a hash function using the most secured cryptographic algorithm available, this is a finding.

Check Text ( C-67005r1_chk )

Review the switch configuration to verify that VTP clients and servers are authenticating messages as shown in the following configuration example:

vtp mode server
vtp version 2
vtp domain ICAN1
vtp password xxxxxxxx

If any switches within the ICAN infrastructure have implemented VTP and are not authenticating VTP messages with a hash function using the most secured cryptographic algorithm available, this is a finding.

Fix Text (F-72435r1_fix)
Configure the switch to authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.