Rapid Spanning Tree Protocol (STP) must be implemented at the access and distribution layers where Virtual Local Area Networks (VLANs) span multiple switches.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66361	NET2004	SV-80851r1_rule		Low

Description
Spanning Tree Protocol (STP) is implemented on bridges and switches to prevent Layer 2 loops when a broadcast domain spans multiple bridges and switches and when redundant links are provisioned to provide high availability in case of link failures. Convergence time can be significantly reduced using Rapid STP (802.1w) instead of STP (802.1d), resulting in improved availability. Rapid STP should be deployed by implementing either Rapid Per-VLAN-Spanning-Tree (Rapid-PVST) or Multiple Spanning-Tree Protocol (MSTP), the later scales much better when there are many VLANs.

Description

Spanning Tree Protocol (STP) is implemented on bridges and switches to prevent Layer 2 loops when a broadcast domain spans multiple bridges and switches and when redundant links are provisioned to provide high availability in case of link failures. Convergence time can be significantly reduced using Rapid STP (802.1w) instead of STP (802.1d), resulting in improved availability. Rapid STP should be deployed by implementing either Rapid Per-VLAN-Spanning-Tree (Rapid-PVST) or Multiple Spanning-Tree Protocol (MSTP), the later scales much better when there are many VLANs.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2019-09-30

Details

Check Text ( C-67007r1_chk )
In cases where VLANs do not span multiple switches it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, then review the switch configuration to verify that RSTP or MSTP has been implemented. Following are example configurations: RSTP spanning-tree mode rapid-pvst MST spanning-tree mode mst spanning-tree mst configuration name Region1 revision 1 instance 1 vlan 10, 11, 12 instance 2 vlan 13, 14 If RSTP or MSTP has not been implemented where STP is required, this is a finding. Note: Note: Cisco has implemented RSTP as part of MSTP and Rapid-PVST+.

Check Text ( C-67007r1_chk )

In cases where VLANs do not span multiple switches it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, then review the switch configuration to verify that RSTP or MSTP has been implemented. Following are example configurations:

RSTP

spanning-tree mode rapid-pvst

MST

spanning-tree mode mst
spanning-tree mst configuration
name Region1
revision 1
instance 1 vlan 10, 11, 12
instance 2 vlan 13, 14

If RSTP or MSTP has not been implemented where STP is required, this is a finding.

Note: Note: Cisco has implemented RSTP as part of MSTP and Rapid-PVST+.

Fix Text (F-72437r1_fix)
Configure Rapid STP be implemented at the access and distribution layers where VLANs span multiple switches.