Detections
Analytics
CISC-L2-000200 - The Cisco switch must have all trunk links enabled statically.
Information
When trunk negotiation is enabled via Dynamic Trunk Protocol (DTP), considerable time can be spent negotiating trunk settings (802.1q or ISL) when a node or interface is restored. While this negotiation is happening, traffic is dropped because the link is up from a Layer 2 perspective.Packet loss can be eliminated by setting the interface statically to trunk mode, thereby avoiding dynamic trunk protocol negotiation and significantly reducing any outage when restoring a failed link or switch.
Solution
Configure the switch to enable trunk links statically as shown in the configuration below:SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk
SW2(config-if)#switchport nonegotiate
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_Switch_Y26M07_STIG.zip
Item Details
Audit Name: DISA Cisco IOS Switch L2S STIG v3r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-220640r1188390_rule, STIG-ID|CISC-L2-000200, STIG-Legacy|SV-110251, STIG-Legacy|V-101147, Vuln-ID|V-220640
Plugin: Cisco
Control ID: fd55069b3f3e47d1fed2c7ae3fa9e09834a282dccf18cf392106a7d64908d678