Detections
Analytics

1.19 CISC-L2-000240

Information

The Cisco switch must not use the default VLAN for management traffic.

GROUP ID: V-220644RULE ID: SV-220644r991852

Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) - all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the switch for management access to use a VLAN other than the default VLAN:

SW1(config)#int vlan 22SW1(config-if)#ip add 10.1.22.3 255.255.255.0SW1(config-if)#no shut

See Also

https://workbench.cisecurity.org/benchmarks/23798

Item Details

Category: CONTINGENCY PLANNING

References: 800-53|CP-8, CCI|CCI-004931, Rule-ID|SV-220644r991852_rule, STIG-ID|CISC-L2-000240, Vuln-ID|V-220644

Plugin: Cisco

Control ID: 51c2d2207378eee663c4e8838d73a662cf1c21af6bebfe95fd772671075856c2