The HP FlexFabric Switch must have all disabled switch ports assigned an unused VLAN.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-66085	SRG-NET-000512-L2S-000007	HFFS-L2-000024	SV-80575r1_rule	2020-06-03	1

Description
It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

ℹ️ Check
Review the HP FlexFabric Switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links. If there are any access switch ports not in use and not in an inactive VLAN, this is a finding. <HP>display vlan X VLAN ID: X VLAN type: Static Route interface: Configured: Description: VLAN 000X Name: VLAN 000X Tagged ports: None Untagged ports: GigabitEthernet1/0/1 GigabitEthernet1/0/2 GigabitEthernet1/0/3 GigabitEthernet1/0/4

ℹ️ Check

Review the HP FlexFabric Switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links. If there are any access switch ports not in use and not in an inactive VLAN, this is a finding. <HP>display vlan X VLAN ID: X VLAN type: Static Route interface: Configured: Description: VLAN 000X Name: VLAN 000X Tagged ports: None Untagged ports: GigabitEthernet1/0/1 GigabitEthernet1/0/2 GigabitEthernet1/0/3 GigabitEthernet1/0/4

✔️ Fix
Assign all switch ports not in use to an inactive VLAN. [HP-vlanX]port GigabitEthernet 1/0/1 to GigabitEthernet 1/0/48