The Cisco PE switch providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221123	CISC-RT-000700	SV-221123r999732_rule	CCI-001095	medium
Description
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.
STIG			Date
Cisco NX OS Switch RTR Security Technical Implementation Guide			2026-03-04

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority

0.50

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

CAP-03Capacity Planning

0.50

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(9)Disconnect or Disable Access

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V2R9our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)DISA STIG Benchmark (XCCDF)V2R9intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-4Information Flow Enforcement

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V10R7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V10R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3Content of Audit Records

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(2)Prevent Program Execution

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-47Alternate Communications Paths

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-5Denial-of-service Protection

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA STIG Benchmark (XCCDF)V10R7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V10R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+3 more (top 10 by confidence shown)

CCI1 mapping

CCI-001095

1.00

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)

NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04

0.50

DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
NIST OLIR Informative ReferenceOLIR 153 (2025-04-07)intersects(normalised)SCF Focal Document mapping (catalog)SCF 2026.2 focalintersects(normalised)

Details

Check Text (C-221123r999732_chk)

Review the switch configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS as shown in the example below: interface Ethernet2/4 no shutdown no switchport storm-control broadcast level 40.00 service instance 1 ethernet encapsulation dot1q 100 If storm control is not enabled at a minimum for broadcast traffic, this is a finding.

Fix Text (F-22827r409859_fix)

Configure storm control for each CE-facing interface as shown in the example below: SW1(config)# int e2/4 SW1(config-if)# storm-control broadcast level 40 SW1(config-if)# end