CISC-L2-000010 - The Cisco switch must be configured to disable non-essential capabilities - no ip boot server

800-53|CM-7

CAT|II

CCI|CCI-000381

Rule-ID|SV-220622r539671_rule

STIG-ID|CISC-L2-000010

STIG-Legacy|SV-110215

STIG-Legacy|V-101111

Vuln-ID|V-220622

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa authentication

CAT|I

CCI|CCI-000778

Rule-ID|SV-220623r539671_rule

STIG-ID|CISC-L2-000020

STIG-Legacy|SV-110217

STIG-Legacy|V-101113

Vuln-ID|V-220623

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa group

800-53|IA-3

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa new-model

800-53|AC-3

800-53|AU-2

800-53|IA-2

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - dot1x system-auth-control

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - interface dot1x

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - radius server

CISC-L2-000030 - The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-220624r539671_rule

STIG-ID|CISC-L2-000030

STIG-Legacy|SV-110219

STIG-Legacy|V-101115

Vuln-ID|V-220624

CISC-L2-000040 - The Cisco switch must manage excess bandwidth to limit the effects of packet-flooding types of denial-of-service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-220625r539671_rule

STIG-ID|CISC-L2-000040

STIG-Legacy|SV-110221

STIG-Legacy|V-101117

Vuln-ID|V-220625

CISC-L2-000060 - The Cisco switch must be configured for authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-220626r539671_rule

STIG-ID|CISC-L2-000060

STIG-Legacy|SV-110223

STIG-Legacy|V-101119

Vuln-ID|V-220626

CISC-L2-000070 - The Cisco switch must be configured for authorized users to remotely view, in real time, all content related to an established user session from a component separate from the Cisco switch.

CCI|CCI-001920

Rule-ID|SV-220627r539671_rule

STIG-ID|CISC-L2-000070

STIG-Legacy|SV-110225

STIG-Legacy|V-101121

Vuln-ID|V-220627

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa authentication

CCI|CCI-001958

Rule-ID|SV-220628r539671_rule

STIG-ID|CISC-L2-000080

STIG-Legacy|SV-110227

STIG-Legacy|V-101123

Vuln-ID|V-220628

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa group

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa new-model

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - dot1x system-auth-control

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - interface dot1x

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - radius server

CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-220629r539671_rule

STIG-ID|CISC-L2-000090

STIG-Legacy|SV-110229

STIG-Legacy|V-101125

Vuln-ID|V-220629

CISC-L2-000100 - The Cisco switch must have Bridge Protocol Data Unit (BPDU) Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220630r539671_rule

STIG-ID|CISC-L2-000100

STIG-Legacy|SV-110231

STIG-Legacy|V-101127

Vuln-ID|V-220630

CISC-L2-000110 - The Cisco switch must have Spanning Tree Protocol (STP) Loop Guard enabled - spanning-tree loopguard

Rule-ID|SV-220631r539671_rule

STIG-ID|CISC-L2-000110

STIG-Legacy|SV-110233

STIG-Legacy|V-101129

Vuln-ID|V-220631

CISC-L2-000110 - The Cisco switch must have Spanning Tree Protocol (STP) Loop Guard enabled - spanning-tree mode

CISC-L2-000120 - The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

Rule-ID|SV-220632r539671_rule

STIG-ID|CISC-L2-000120

STIG-Legacy|SV-110235

STIG-Legacy|V-101131

Vuln-ID|V-220632

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping

800-53|SI-4(11)

Rule-ID|SV-220633r539671_rule

STIG-ID|CISC-L2-000130

STIG-Legacy|SV-110237

STIG-Legacy|V-101133

Vuln-ID|V-220633

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping vlan

CISC-L2-000140 - The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220634r539671_rule

STIG-ID|CISC-L2-000140

STIG-Legacy|SV-110239

STIG-Legacy|V-101135

Vuln-ID|V-220634

CISC-L2-000150 - The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.

Rule-ID|SV-220635r539671_rule

STIG-ID|CISC-L2-000150

STIG-Legacy|SV-110241

STIG-Legacy|V-101137

Vuln-ID|V-220635

CISC-L2-000160 - The Cisco switch must have Storm Control configured on all host-facing switchports.

800-53|CM-6

CCI|CCI-000366

Rule-ID|SV-220636r648763_rule

STIG-ID|CISC-L2-000160

STIG-Legacy|SV-110243

STIG-Legacy|V-101139

Vuln-ID|V-220636

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping

Rule-ID|SV-220637r539671_rule

STIG-ID|CISC-L2-000170

STIG-Legacy|SV-110245

STIG-Legacy|V-101141

Vuln-ID|V-220637

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping vlan

CISC-L2-000180 - The Cisco switch must implement Rapid Spanning Tree Protocol (STP) where VLANs span multiple switches with redundant links.

Rule-ID|SV-220638r539671_rule

STIG-ID|CISC-L2-000180

STIG-Legacy|SV-110247

STIG-Legacy|V-101143

Vuln-ID|V-220638

CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

Rule-ID|SV-220639r539671_rule

STIG-ID|CISC-L2-000190

STIG-Legacy|SV-110249

STIG-Legacy|V-101145

Vuln-ID|V-220639

CISC-L2-000200 - The Cisco switch must have all trunk links enabled statically.

Rule-ID|SV-220640r539671_rule

STIG-ID|CISC-L2-000200

STIG-Legacy|SV-110251

STIG-Legacy|V-101147

Vuln-ID|V-220640

CISC-L2-000210 - The Cisco switch must have all disabled switch ports assigned to an unused VLAN.

Rule-ID|SV-220641r539671_rule

STIG-ID|CISC-L2-000210

STIG-Legacy|SV-110253

STIG-Legacy|V-101149

Vuln-ID|V-220641

CISC-L2-000220 - The Cisco switch must not have the default VLAN assigned to any host-facing switch ports.

Rule-ID|SV-220642r539671_rule

STIG-ID|CISC-L2-000220

STIG-Legacy|SV-110255

STIG-Legacy|V-101151

Vuln-ID|V-220642

CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it.

Rule-ID|SV-220643r539671_rule

STIG-ID|CISC-L2-000230

STIG-Legacy|SV-110257

STIG-Legacy|V-101153

Vuln-ID|V-220643

CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic.

Rule-ID|SV-220644r539671_rule

STIG-ID|CISC-L2-000240

STIG-Legacy|SV-110259

STIG-Legacy|V-101155

Vuln-ID|V-220644

CISC-L2-000250 - The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

Rule-ID|SV-220645r539671_rule

STIG-ID|CISC-L2-000250

STIG-Legacy|SV-110261

STIG-Legacy|V-101157

Vuln-ID|V-220645

CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Rule-ID|SV-220646r539671_rule

STIG-ID|CISC-L2-000260

STIG-Legacy|SV-110263

STIG-Legacy|V-101159

Vuln-ID|V-220646

CISC-L2-000270 - The Cisco switch must not have any switchports assigned to the native VLAN.

Detections

Analytics

DISA STIG Cisco IOS Switch L2S v2r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Oct 27, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jul 30, 2021 Miscellaneous Metadata updated. References updated.