OpenControls Logo

STIG Viewer

STIGViewer Support

The HP FlexFabric Switch must have BPDU Guard enabled on all user-facing access ports.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-66065HFFS-L2-000011SV-80555r1_ruleCCI-002385medium
Description
If a rogue switch is introduced into the topology and transmits a Bridge Protocol Data Unit (BPDU) with a lower bridge priority than the existing root bridge, it will become the new root bridge and cause a topology change, rendering the network in a suboptimal state. The Spanning Tree Protocol (STP) PortFast BPDU guard enhancement allows network designers to enforce the STP domain borders and keep the active topology predictable. The devices behind the ports that have STP PortFast enabled are not able to influence the STP topology. At the reception of BPDUs, the BPDU guard operation disables the port that has PortFast configured. The BPDU guard transitions the port into errdisable state and sends a log message.
STIGDate
HP FlexFabric Switch L2S Security Technical Implementation Guide2020-06-03

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01Continuous Monitoring
1.00
MON-01.1Intrusion Detection & Prevention Systems (IDS & IPS)
1.00
MON-01.3Inbound & Outbound Communications Traffic
1.00
MON-01.4System Generated Alerts
1.00
MON-01.8Security Event Monitoring
1.00
NET-01Network Security Controls (NSC)
1.00
NET-02Layered Network Defenses
1.00
SEA-01Secure Engineering Principles
1.00
SEA-02Alignment With Enterprise Architecture
1.00
CAP-01Capacity & Performance Management
0.50

+3 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (36) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-5Response to Audit Logging Process Failures
1.00
CM-11(2)Software Installation with Privileged Status
1.00

+26 more (top 10 by confidence shown)

CCI1 mapping
CCI-002385
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.IR-01
1.00
PR.IR-04
0.50

Who does this work

12 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-80555r1_chk)

Review the HP FlexFabric Switch configuration to verify that BPDU Protection is enabled on all user-facing switch ports. If the HP FlexFabric Switch has not enabled BPDU protection, this is a finding. [HP] display stp -------[CIST Global Info][Mode MSTP]------- Bridge ID : 32768.7848-596a-6580 Bridge times : Hello 2s MaxAge 20s FwdDelay 15s MaxHops 20 Root ID/ERPC : 32768.7848-596a-6580, 0 RegRoot ID/IRPC : 32768.7848-596a-6580, 0 RootPort ID : 0.0 BPDU-Protection : Enabled Bridge Config- Digest-Snooping : Disabled TC or TCN received : 0 Time since last TC : 3 days interface GigabitEthernet1/0/1 stp edged-port

Fix Text (F-72141r1_fix)

Configure the HP FlexFabric Switch to have BPDU Guard enabled on all user-facing switch ports. [HP]stp bpdu-protection [HP-GigabitEthernet1/0/1]stp edged-port