STIGQter STIGQter: STIG Summary: Cisco NX-OS Switch L2S Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 08 May 2020:

The Cisco switch must have IGMP or MLD Snooping configured on all VLANs.

DISA Rule

SV-110351r1_rule

Vulnerability Number

V-101247

Group Title

SRG-NET-000512-L2S-000002

Rule Version

CISC-L2-000170

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively globally.

SW1(config)# ip igmp snooping

Check Contents

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively. The example below are the steps to verify that IGMP snooping is enabled for each VLAN.

Step 1: Verify that IGMP or MLD snooping is enabled globally. By default, IGMP snooping is enabled globally; hence, the following command should not be in the switch configuration:

no ip igmp snooping

Step 2: Verify that IGMP snooping is not disabled for any VLAN as shown in the example below:

no ip igmp snooping vlan 11

Note: When globally enabled, it is also enabled by default on all VLANs, but can be disabled on a per-VLAN basis. If global snooping is disabled, VLAN snooping cannot be enabled. If global snooping is enabled, VLAN snooping cannot be enabled or disabled.

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-101247

Documentable

False

Rule Version

CISC-L2-000170

Severity Override Guidance

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively. The example below are the steps to verify that IGMP snooping is enabled for each VLAN.

Step 1: Verify that IGMP or MLD snooping is enabled globally. By default, IGMP snooping is enabled globally; hence, the following command should not be in the switch configuration:

no ip igmp snooping

Step 2: Verify that IGMP snooping is not disabled for any VLAN as shown in the example below:

no ip igmp snooping vlan 11

Note: When globally enabled, it is also enabled by default on all VLANs, but can be disabled on a per-VLAN basis. If global snooping is disabled, VLAN snooping cannot be enabled. If global snooping is enabled, VLAN snooping cannot be enabled or disabled.

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

3551

Comments