Detections
Analytics

1.1 CISC-L2-000020

Information

The Cisco switch must uniquely identify and authenticate all network-connected endpoint devices before establishing any connection.

GROUP ID: V-220623RULE ID: SV-220623r863275

Controlling LAN access via 802.1x authentication can assist in preventing a malicious user from connecting an unauthorized PC to a switch port to inject or receive data from the network without detection.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure 802.1 x authentications on all host-facing access switch ports. To authenticate devices that do not support 802.1x, MAC Authentication Bypass must be configured.

Step 1: Configure the radius servers as shown in the example below:

SW1(config)#radius server RADIUS_1SW1(config-radius-server)#address ipv4 10.1.22.3SW1(config-radius-server)#key xxxxxxSW1(config-radius-server)#exitSW1(config)#radius server RADIUS_2SW1(config-radius-server)#address ipv4 10.1.14.5SW1(config-radius-server)#key xxxxxxSW1(config-radius-server)#exit

Step 2: Enable 802.1x authentication on the switch:

SW1(config)#aaa new-modelSW1(config)#aaa group server radius RADIUS_SERVERSSW1(config-sg-radius)#server name RADIUS_1SW1(config-sg-radius)#server name RADIUS_2SW1(config-sg-radius)#exitSW1(config)#aaa authentication dot1x default group RADIUS_SERVERSSW1(config)#dot1x system-auth-control

Step 3: Enable 802.1x on all host-facing interfaces as shown in the example below:

SW1(config)#int range g1/0 - 8SW1(config-if-range)#switchport mode accessSW1(config-if-range)#authentication host-mode single-hostSW1(config-if-range)#dot1x pae authenticatorSW1(config-if-range)#authentication port-control autoSW1(config-if-range)#end

Note: Single-host is the default. Host-mode multi-domain (for VoIP phone plus PC) or multi-auth (multiple PCs connected to a hub) can be configured as alternatives.

See Also

https://workbench.cisecurity.org/benchmarks/23798

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3, CCI|CCI-000778, CCI|CCI-001958, Rule-ID|SV-220623r863275_rule, STIG-ID|CISC-L2-000020, Vuln-ID|V-220623

Plugin: Cisco

Control ID: 5800f1b4c2de25b94a200bc9d16bf233237fd7741b895399fa0c522d9194829f