Detections
Analytics

1.17 CISC-L2-000240

Information

The Cisco switch must not use the default VLAN for management traffic.

GROUP ID: V-220693
RULE ID: SV-220693r991949

Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)-all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

Solution

Configure the switch for management access to use a VLAN other than the default VLAN.

SW1(config)# interface vlan 44
SW1(config-if)# ip add 10.1.12.1/24
SW1(config-if)# end

See Also

https://workbench.cisecurity.org/benchmarks/23772

Item Details

Category: CONTINGENCY PLANNING

References: 800-53|CP-8, CAT|II, CCI|CCI-004931, Rule-ID|SV-220693r991949_rule, STIG-ID|CISC-L2-000240, Vuln-ID|V-220693

Plugin: Cisco

Control ID: 2b2fe73d4007556ce00bab139d6a216b690cd8421c84134bdd4f074fc2bdb60a