Detections
Analytics

1.15 CISC-L2-000200

Information

The Cisco switch must have all trunk links enabled statically.

GROUP ID: V-220640RULE ID: SV-220640r539671

When trunk negotiation is enabled via Dynamic Trunk Protocol (DTP), considerable time can be spent negotiating trunk settings (802.1q or ISL) when a node or interface is restored. While this negotiation is happening, traffic is dropped because the link is up from a Layer 2 perspective.

Packet loss can be eliminated by setting the interface statically to trunk mode, thereby avoiding dynamic trunk protocol negotiation and significantly reducing any outage when restoring a failed link or switch.

Solution

Configure the switch to enable trunk links statically as shown in the configuration below:

SW2(config-if)#switchport trunk encapsulation dot1qSW2(config-if)#switchport mode trunkSW2(config-if)#switchport nonegotiate

See Also

https://workbench.cisecurity.org/benchmarks/23798

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-220640r539671_rule, STIG-ID|CISC-L2-000200, Vuln-ID|V-220640

Plugin: Cisco

Control ID: f9353359ee8f867c1531905a8de08547d3c97ae87e82e56bd8c8d8e913d983d9