Detections
Analytics
OS10-RTR-000160 - The Dell OS10 Router must be configured to have all inactive interfaces disabled.
Information
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use.If an interface is no longer used, the configuration must be deleted and the interface disabled. For subinterfaces, delete subinterfaces that are on inactive interfaces and delete subinterfaces that are themselves inactive. If the subinterface is no longer necessary for authorized communications, it must be deleted.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Disable all inactive interfaces on the router as shown in the example below.OS10(config)# default interface ethernet 1/1/6
OS10(config)# interface ethernet 1/1/6
OS10(conf-if-eth1/1/6)# no switchport
OS10(conf-if-eth1/1/6)# shutdown
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Dell_OS10_Switch_Y24M12_STIG.zip
Item Details
Audit Name: DISA Dell OS10 Switch Router STIG v1r1
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|III, CCI|CCI-001414, Rule-ID|SV-269859r1051962_rule, STIG-ID|OS10-RTR-000160, Vuln-ID|V-269859
Plugin: Dell_OS10
Control ID: 0a0f16504f2cc00d1b1cf7364835b190c597aee85c29d0e425f0d2e26a9e9845