Detections
Analytics

CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch that the victim is connected to. If the attacker knows the victim's MAC address, it can forge a frame with two 802.1q tags and a Layer 2 header with the destination address of the victim.

Because the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to the victim's switch will remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame on to the trunk link, unaware of the inner tag with a VLAN ID of which the victim's switch port is a member.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To ensure the integrity of the trunk link and prevent unauthorized access, the ID of the native VLAN of the trunk port must be changed from the default VLAN (i.e., VLAN 1) to its own unique VLAN ID.

SW1(config)#int g0/1
SW1(config-if)#switchport trunk native vlan 44

Note: The native VLAN ID must be the same on both ends of the trunk link; otherwise, traffic could accidentally leak between broadcast domains.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_Switch_Y22M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-220646r539671_rule, STIG-ID|CISC-L2-000260, STIG-Legacy|SV-110263, STIG-Legacy|V-101159, Vuln-ID|V-220646

Plugin: Cisco

Control ID: a252094dc18961a494824ecb44a92a90cb0f19e5246780ba2be81cd4ca2a7c04