Detections
Analytics

CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)-all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the switch for management access to use a VLAN other than the default VLAN.

SW1(config)# interface vlan 44
SW1(config-if)# ip add 10.1.12.1/24
SW1(config-if)# end

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_NX-OS_Switch_Y24M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-220693r539671_rule, STIG-ID|CISC-L2-000240, STIG-Legacy|SV-110361, STIG-Legacy|V-101257, Vuln-ID|V-220693

Plugin: Cisco

Control ID: 30a4373f6d2a20b6eed1a29f1105329d833bba39af251d6e76c1ef5dd1f40cab