CISC-L2-000010 - The Cisco switch must be configured to disable non-essential capabilities - no ip boot server

800-53|CM-7

CAT|II

CCI|CCI-000381

Rule-ID|SV-220648r539671_rule

STIG-ID|CISC-L2-000010

STIG-Legacy|SV-110267

STIG-Legacy|V-101163

Vuln-ID|V-220648

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa authentication

CAT|I

CCI|CCI-000778

Rule-ID|SV-220649r539671_rule

STIG-ID|CISC-L2-000020

STIG-Legacy|SV-110269

STIG-Legacy|V-101165

Vuln-ID|V-220649

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa group

800-53|IA-3

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa new-model

800-53|AC-3

800-53|AU-2

800-53|IA-2

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - dot1x system-auth-control

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - interface dot1x

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - radius server

CISC-L2-000030 - The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-220650r539671_rule

STIG-ID|CISC-L2-000030

STIG-Legacy|SV-110271

STIG-Legacy|V-101167

Vuln-ID|V-220650

CISC-L2-000040 - The Cisco switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-220651r539671_rule

STIG-ID|CISC-L2-000040

STIG-Legacy|SV-110273

STIG-Legacy|V-101169

Vuln-ID|V-220651

CISC-L2-000060 - The Cisco switch must be configured for authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-220652r539671_rule

STIG-ID|CISC-L2-000060

STIG-Legacy|SV-110275

STIG-Legacy|V-101171

Vuln-ID|V-220652

CISC-L2-000070 - The Cisco switch must be configured to provide the capability for authorized users to remotely view, in real time, all content related to an established user session from a component separate from the Cisco switch.

CCI|CCI-001920

Rule-ID|SV-220653r539671_rule

STIG-ID|CISC-L2-000070

STIG-Legacy|SV-110277

STIG-Legacy|V-101173

Vuln-ID|V-220653

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa authentication

CCI|CCI-001958

Rule-ID|SV-220654r539671_rule

STIG-ID|CISC-L2-000080

STIG-Legacy|SV-110279

STIG-Legacy|V-101175

Vuln-ID|V-220654

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa group

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa new-model

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - dot1x system-auth-control

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - interface dot1x

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - radius server

CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-220655r539671_rule

STIG-ID|CISC-L2-000090

STIG-Legacy|SV-110281

STIG-Legacy|V-101177

Vuln-ID|V-220655

CISC-L2-000100 - The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports - BPDU Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220656r539671_rule

STIG-ID|CISC-L2-000100

STIG-Legacy|SV-110283

STIG-Legacy|V-101179

Vuln-ID|V-220656

CISC-L2-000110 - The Cisco switch must have STP Loop Guard enabled - spanning-tree loopguard

Rule-ID|SV-220657r539671_rule

STIG-ID|CISC-L2-000110

STIG-Legacy|SV-110285

STIG-Legacy|V-101181

Vuln-ID|V-220657

CISC-L2-000110 - The Cisco switch must have STP Loop Guard enabled - spanning-tree mode

CISC-L2-000120 - The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

Rule-ID|SV-220658r539671_rule

STIG-ID|CISC-L2-000120

STIG-Legacy|SV-110287

STIG-Legacy|V-101183

Vuln-ID|V-220658

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping

800-53|SI-4(11)

Rule-ID|SV-220659r539671_rule

STIG-ID|CISC-L2-000130

STIG-Legacy|SV-110289

STIG-Legacy|V-101185

Vuln-ID|V-220659

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping vlan

CISC-L2-000140 - The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-220660r539671_rule

STIG-ID|CISC-L2-000140

STIG-Legacy|SV-110291

STIG-Legacy|V-101187

Vuln-ID|V-220660

CISC-L2-000150 - The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.

Rule-ID|SV-220661r539671_rule

STIG-ID|CISC-L2-000150

STIG-Legacy|SV-110293

STIG-Legacy|V-101189

Vuln-ID|V-220661

CISC-L2-000160 - The Cisco switch must have Storm Control configured on all host-facing switchports.

800-53|CM-6

CCI|CCI-000366

Rule-ID|SV-220662r648766_rule

STIG-ID|CISC-L2-000160

STIG-Legacy|SV-110295

STIG-Legacy|V-101191

Vuln-ID|V-220662

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping

Rule-ID|SV-220663r539671_rule

STIG-ID|CISC-L2-000170

STIG-Legacy|SV-110297

STIG-Legacy|V-101193

Vuln-ID|V-220663

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping vlan

CISC-L2-000180 - The Cisco switch must implement Rapid STP where VLANs span multiple switches with redundant links - STP where VLANs span multiple switches with redundant links.

Rule-ID|SV-220664r539671_rule

STIG-ID|CISC-L2-000180

STIG-Legacy|SV-110303

STIG-Legacy|V-101199

Vuln-ID|V-220664

CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

Rule-ID|SV-220665r539671_rule

STIG-ID|CISC-L2-000190

STIG-Legacy|SV-110305

STIG-Legacy|V-101201

Vuln-ID|V-220665

CISC-L2-000200 - The Cisco switch must have all trunk links enabled statically.

Rule-ID|SV-220666r539671_rule

STIG-ID|CISC-L2-000200

STIG-Legacy|SV-110307

STIG-Legacy|V-101203

Vuln-ID|V-220666

CISC-L2-000210 - The Cisco switch must have all disabled switch ports assigned to an unused VLAN.

Rule-ID|SV-220667r539671_rule

STIG-ID|CISC-L2-000210

STIG-Legacy|SV-110309

STIG-Legacy|V-101205

Vuln-ID|V-220667

CISC-L2-000220 - The Cisco switch must not have the default VLAN assigned to any host-facing switch ports.

Rule-ID|SV-220668r539671_rule

STIG-ID|CISC-L2-000220

STIG-Legacy|SV-110311

STIG-Legacy|V-101207

Vuln-ID|V-220668

CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it.

Rule-ID|SV-220669r539671_rule

STIG-ID|CISC-L2-000230

STIG-Legacy|SV-110313

STIG-Legacy|V-101209

Vuln-ID|V-220669

CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic.

Rule-ID|SV-220670r539671_rule

STIG-ID|CISC-L2-000240

STIG-Legacy|SV-110315

STIG-Legacy|V-101211

Vuln-ID|V-220670

CISC-L2-000250 - The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

Rule-ID|SV-220671r539671_rule

STIG-ID|CISC-L2-000250

STIG-Legacy|SV-110317

STIG-Legacy|V-101213

Vuln-ID|V-220671

CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Rule-ID|SV-220672r539671_rule

STIG-ID|CISC-L2-000260

STIG-Legacy|SV-110319

STIG-Legacy|V-101215

Vuln-ID|V-220672

CISC-L2-000270 - The Cisco switch must not have any switchports assigned to the native VLAN.

Detections

Analytics

DISA STIG Cisco IOS XE Switch L2S v1r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 Aug 11, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.4 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.3 Jun 17, 2021 Miscellaneous Metadata updated.
Revision 1.2 Apr 28, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Nov 9, 2020 Miscellaneous Metadata updated. See also link updated.