Detections
Analytics

1.1.8 VLAN Management

Information

VLAN 1 is a special VLAN that tags and handles most of the control plane traffic. VLAN 1 is enabled on all trunks and ports by default. Ensure VLAN1 is pruned from all trunk and access ports that do not require it.

Instability in one part of the network could affect VLAN 1, thereby influencing control-plane stability and therefore STP stability for all other VLANs.

Solution

switch(config)# vlan 1
switch(config-vlan-1)# state suspend

switch(config)# interface Ethernet[X]
switch(config-if-EtX)# switchport trunk allowed vlan except 1

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(18)

Plugin: Arista

Control ID: b6e0478dc97e06dbac46d6744662024a22094b1fc39f8cce0044cdfd5a1d9be4