The Cisco switch must not use the default VLAN for management traffic.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-220644 | CISC-L2-000240 | SV-220644r991852_rule | CCI-004931 | medium |
| Description | ||||
| Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP) - all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly. | ||||
| STIG | Date | |||
| Cisco IOS Switch L2S Security Technical Implementation Guide | 2024-06-06 | |||
Details
Check Text (C-220644r991852_chk)
Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it:
SW1#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-998,1000-4094
Gi0/2 1-4094
If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.
Fix Text (F-22348r507979_fix)
Configure the switch for management access to use a VLAN other than the default VLAN:
SW1(config)#int vlan 22
SW1(config-if)#ip add 10.1.22.3 255.255.255.0
SW1(config-if)#no shut