STIGQter: STIG Summary: SEL-2740S L2S Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 02 May 2019:

The SEL-2740S must uniquely identify all network-connected endpoint devices before establishing any connection.

DISA Rule

SV-102363r1_rule

Vulnerability Number

V-92263

Group Title

SRG-NET-000148-L2S-000015

Rule Version

SELS-SW-000020

Severity

CAT I

CCI(s)

• CCI-000778 - The information system uniquely identifies an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.

Weight

10

Fix Recommendation

For adding an SEL-2740S Flow Rule to forward traffic, do the following:
1. Log in to OTSDN Controller using Permission Level 3.
2. Click "Flow Entries" in Navigation Menu.
3. Click "Add Flow" button.
4. Enter General Setting values for "Switch", "Enable". Optional: Enter General Settings for "Table ID", "Priority", "Idle Timeout", and "Hard Timeout".
5. Depending on communication protocol behavior, enter appropriate Match Field values for "ARP Opcode" ("Request" or "Reply"), "ARP Source", "ARP Target", "Communication Service Type (CST) Match", "Ethernet Destination", "Ethernet Source", "Ethernet Type", "InPort", "IP Proto", "IPv4 Destination", "IPv4 Source", "TCP Destination", "TCP Source", "UDP Destination", "UDP Source", "VLAN Priority", and/or "VLAN Virtually ID".
6. Enter appropriate Write-Actions for "Pop VLAN ID", "Push VLAN ID", "Set VLAN ID", "Set VLAN Priority", "Set Queue", "Group by Alias or Value", and/or "Output by Alias or Value".
7. Click "Submit".
8. Repeat for every switch necessary.

Check Contents

Review SEL-2740S flow rules to ensure they contain the proper match criteria (MAC, IP, Port, SRC, DST, etc.) for the connected hosts restricting all other access to the network.

If the SEL-2740S is configured with flows with wildcard or unnecessary packet forwarding rules, this is a finding.

Vulnerability Number

V-92263

Documentable

False

Rule Version

SELS-SW-000020

Severity Override Guidance

Review SEL-2740S flow rules to ensure they contain the proper match criteria (MAC, IP, Port, SRC, DST, etc.) for the connected hosts restricting all other access to the network.

If the SEL-2740S is configured with flows with wildcard or unnecessary packet forwarding rules, this is a finding.

Check Content Reference

M

Target Key

3385

Comments