CISC-L2-000010 - The Cisco switch must be configured to disable non-essential capabilities.

800-53|CM-7

CAT|II

CCI|CCI-000381

Rule-ID|SV-110323r1_rule

STIG-ID|CISC-L2-000010

Vuln-ID|V-101219

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa authentication

CAT|I

CCI|CCI-000778

Rule-ID|SV-110325r1_rule

STIG-ID|CISC-L2-000020

Vuln-ID|V-101221

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - aaa group

800-53|AU-10

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - dot1x port-control auto

800-53|IA-3

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - interface dot1x

CISC-L2-000020 - The Cisco switch must uniquely identify all network-connected endpoint devices before establishing any connection - radius server

CISC-L2-000030 - The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-110327r1_rule

STIG-ID|CISC-L2-000030

Vuln-ID|V-101223

CISC-L2-000060 - The Cisco switch must be configured for authorized users to select a user session to capture.

800-53|AU-14

CCI|CCI-001919

Rule-ID|SV-110329r1_rule

STIG-ID|CISC-L2-000060

Vuln-ID|V-101225

CISC-L2-000070 - The Cisco switch must be configured for authorized users to remotely view, in real time, all content related to an established user session from a component separate from The Cisco switch.

CCI|CCI-001920

Rule-ID|SV-110331r1_rule

STIG-ID|CISC-L2-000070

Vuln-ID|V-101227

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa authentication

CCI|CCI-001958

Rule-ID|SV-110333r1_rule

STIG-ID|CISC-L2-000080

Vuln-ID|V-101229

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - aaa group

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - dot1x port-control auto

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - interface dot1x

CISC-L2-000080 - The Cisco switch must authenticate all endpoint devices before establishing any connection - radius server

CISC-L2-000090 - The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.

800-53|SC-5

CAT|III

CCI|CCI-002385

Rule-ID|SV-110335r1_rule

STIG-ID|CISC-L2-000090

Vuln-ID|V-101231

CISC-L2-000100 - The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports - BPDU Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-110337r1_rule

STIG-ID|CISC-L2-000100

Vuln-ID|V-101233

CISC-L2-000110 - The Cisco switch must have STP Loop Guard enabled.

Rule-ID|SV-110339r1_rule

STIG-ID|CISC-L2-000110

Vuln-ID|V-101235

CISC-L2-000120 - The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

Rule-ID|SV-110341r1_rule

STIG-ID|CISC-L2-000120

Vuln-ID|V-101237

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping

800-53|SI-4(11)

Rule-ID|SV-110343r1_rule

STIG-ID|CISC-L2-000130

Vuln-ID|V-101239

CISC-L2-000130 - The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources - ip dhcp snooping vlan

CISC-L2-000140 - The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

Rule-ID|SV-110345r1_rule

STIG-ID|CISC-L2-000140

Vuln-ID|V-101241

CISC-L2-000150 - The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.

Rule-ID|SV-110347r1_rule

STIG-ID|CISC-L2-000150

Vuln-ID|V-101243

CISC-L2-000160 - The Cisco switch must have Storm Control configured on all host-facing switchports.

800-53|CM-6

CCI|CCI-000366

Rule-ID|SV-110349r1_rule

STIG-ID|CISC-L2-000160

Vuln-ID|V-101245

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping

Rule-ID|SV-110351r1_rule

STIG-ID|CISC-L2-000170

Vuln-ID|V-101247

CISC-L2-000170 - The Cisco switch must have IGMP or MLD Snooping configured on all VLANs - ip igmp snooping vlan

CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections - feature udld

Rule-ID|SV-110353r1_rule

STIG-ID|CISC-L2-000190

Vuln-ID|V-101249

CISC-L2-000190 - The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections - interfaces

CISC-L2-000210 - The Cisco switch must have all disabled switch ports assigned to an unused VLAN.

Rule-ID|SV-110355r1_rule

STIG-ID|CISC-L2-000210

Vuln-ID|V-101251

CISC-L2-000220 - The Cisco switch must not have the default VLAN assigned to any host-facing switch ports.

Rule-ID|SV-110357r1_rule

STIG-ID|CISC-L2-000220

Vuln-ID|V-101253

CISC-L2-000230 - The Cisco switch must have the default VLAN pruned from all trunk ports that do not require it.

Rule-ID|SV-110359r1_rule

STIG-ID|CISC-L2-000230

Vuln-ID|V-101255

CISC-L2-000240 - The Cisco switch must not use the default VLAN for management traffic.

Rule-ID|SV-110361r1_rule

STIG-ID|CISC-L2-000240

Vuln-ID|V-101257

CISC-L2-000250 - The Cisco switch must have all user-facing or untrusted ports configured as access switch ports.

Rule-ID|SV-110363r1_rule

STIG-ID|CISC-L2-000250

Vuln-ID|V-101259

CISC-L2-000260 - The Cisco switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Rule-ID|SV-110365r1_rule

STIG-ID|CISC-L2-000260

Vuln-ID|V-101261

CISC-L2-000270 - The Cisco switch must not have any switchports assigned to the native VLAN.

Detections

Analytics

DISA STIG Cisco NX-OS Switch L2S v2r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.6 Sep 19, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.5 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.4 Apr 25, 2022 Miscellaneous Metadata updated.
Revision 1.3 Apr 5, 2022 Miscellaneous Metadata updated. References updated. See also link updated.
Revision 1.2 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Jun 17, 2021 Miscellaneous Metadata updated.