The Dell OS10 Switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-269958	SRG-NET-000362-L2S-000024	OS10-L2S-000120	SV-269958r1052260_rule	2024-12-11	1

Description
Access layer switches use the Content Addressable Memory (CAM) table to direct traffic to specific ports based on the VLAN number and the destination MAC address of the frame. When a router has an Address Resolution Protocol (ARP) entry for a destination host and forwards it to the access layer switch and there is no entry corresponding to the frame's destination MAC address in the incoming VLAN, the frame will be sent to all forwarding ports within the respective VLAN, which causes flooding. Large amounts of flooded traffic can saturate low-bandwidth links, causing network performance issues or complete connectivity outage to the connected devices. Unknown unicast flooding has been a nagging problem in networks that have asymmetric routing and default timers. To mitigate the risk of a connectivity outage, the Unknown Unicast Flood Blocking (UUFB) feature must be implemented on all access layer switches. The UUFB feature will block unknown unicast traffic flooding and only permit egress traffic with MAC addresses that are known to exit on the port.

Description

Access layer switches use the Content Addressable Memory (CAM) table to direct traffic to specific ports based on the VLAN number and the destination MAC address of the frame. When a router has an Address Resolution Protocol (ARP) entry for a destination host and forwards it to the access layer switch and there is no entry corresponding to the frame's destination MAC address in the incoming VLAN, the frame will be sent to all forwarding ports within the respective VLAN, which causes flooding. Large amounts of flooded traffic can saturate low-bandwidth links, causing network performance issues or complete connectivity outage to the connected devices. Unknown unicast flooding has been a nagging problem in networks that have asymmetric routing and default timers. To mitigate the risk of a connectivity outage, the Unknown Unicast Flood Blocking (UUFB) feature must be implemented on all access layer switches. The UUFB feature will block unknown unicast traffic flooding and only permit egress traffic with MAC addresses that are known to exit on the port.

ℹ️ Check
Review the Dell OS10 Switch configuration to verify that unknown unicast traffic is blocked by storm control is on all host-facing switch ports. For each host-facing switch port: interface ethernet1/1/1 switchport access vlan 100 storm-control unknown-unicast 1 If the switch has not enabled unknown unicast storm control on all host-facing switch ports, this is a finding.

✔️ Fix
Configure the Dell OS10 Switch to enable storm control is on all host-facing switch ports as shown in the example below: OS10(config)# interface ethernet 1/1/1 OS10(conf-if-eth1/1/1)# storm-control unknown-unicast 1