DISA STIG Cisco IOS XE Switch L2S v2r2

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA STIG Cisco IOS XE Switch L2S v2r2

Updated: 2/21/2023

Authority: Network Devices

Plugin: Cisco

Revision: 1.5

Estimated Item Count: 40

Audit Changelog


Revision 1.5 Feb 21, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated. Variables updated.
Revision 1.4 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.3 Sep 30, 2022 Informational Update CISC-L2-000010 - The Cisco switch must be configured to disable non-essential capabilities - no ip boot server CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa authentication CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa group CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa new-model CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - dot1x system-auth-control CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - interface dot1x CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - radius server CISC-L2-000030 - The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available. CISC-L2-000040 - The Cisco switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks. CISC-L2-000060 - The Cisco switch must be configured for authorized users to select a user session to capture. CISC-L2-000070 - The Cisco switch must be configured to provide the capability for authorized users to remotely view, in real time, all content related to an established user session from a component separate from the Cisco switch. CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa authentication CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa group CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa new-model CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - dot1x system-auth-control CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - interface dot1x CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - radius server CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts. CISC-L2-000100 - The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports - BPDU Guard enabled on all user-facing or untrusted access switch ports. CISC-L2-000120 - The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled. CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping vlan CISC-L2-000140 - The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports. CISC-L2-000150 - The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs. CISC-L2-000160 - The Cisco switch must have Storm Control configured on all host-facing switchports. CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping vlan CISC-L2-000180 - The Cisco switch must implement Rapid STP where VLANs span multiple switches with redundant links - STP where VLANs span multiple switches with redundant links. CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections. CISC-L2-000200 - The Cisco switch must have all trunk links enabled statically. CISC-L2-000210 - The Cisco switch must have all disabled switch ports assigned to an unused VLAN. CISC-L2-000220 - The Cisco switch must not have the default VLAN assigned to any host-facing switch ports. CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it. CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic. CISC-L2-000250 - The Cisco switch must have all user-facing or untrusted ports configured as access switch ports. CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links. CISC-L2-000270 - The Cisco switch must not have any switchports assigned to the native VLAN. Miscellaneous Platform check updated. Variables updated. Added DISA_STIG_Cisco_IOS_XE_Switch_L2S_v2r2.audit from DISA Cisco IOS XE Switch L2S v2r2 STIG
Revision 1.2 Aug 17, 2022 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 Apr 25, 2022 Miscellaneous References updated.