OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco switch must not have the default VLAN assigned to any host-facing switch ports.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-220668CISC-L2-000220SV-220668r991905_ruleCCI-004891medium
Description
In a VLAN-based network, switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.
STIGDate
Cisco IOS XE Switch L2S Security Technical Implementation Guide2025-05-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CLD-03Cloud Infrastructure Security Subnet
0.50
NET-03.8Separate Subnet for Connecting to Different Security Domains
0.50
NET-06.1Security Management Subnets
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
SC-47Alternate Communications Paths
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-8Transmission Confidentiality and Integrity
1.00
CCI1 mapping
CCI-004891
1.00

Details

Check Text (C-220668r991905_chk)

Review the switch configurations and verify that no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1). VLAN assignments can be verified via the show vlan command. SW1#show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active 10 User VLAN active Gi0/3, Gi1/0, Gi1/1, Gi1/2 Gi1/3, Gi2/1 20 Management VLAN active Gi0/2 999 VLAN0999 active Gi2/0 If there are access switch ports assigned to the default VLAN, this is a finding.

Fix Text (F-22372r507553_fix)

Remove the assignment of the default VLAN from all access switch ports.