The Cisco switch must not use the default VLAN for management traffic.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-220644 | SRG-NET-000512-L2S-000010 | CISC-L2-000240 | SV-220644r991852_rule | 2024-06-06 | 3 |
| Description |
|---|
| Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) - all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly. |
| ℹ️ Check |
|---|
| Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it: SW1#show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-998,1000-4094 Gi0/2 1-4094 If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding. |
| ✔️ Fix |
|---|
| Configure the switch for management access to use a VLAN other than the default VLAN: SW1(config)#int vlan 22 SW1(config-if)#ip add 10.1.22.3 255.255.255.0 SW1(config-if)#no shut |