STIGQter: STIG Summary: Cisco IOS Switch L2S Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco switch must implement Rapid Spanning Tree Protocol (STP) where VLANs span multiple switches with redundant links.

DISA Rule

SV-220638r539671_rule

Vulnerability Number

V-220638

Group Title

SRG-NET-000512-L2S-000003

Rule Version

CISC-L2-000180

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure Rapid STP or MSTP to be implemented at the access and distribution layers where VLANs span multiple switches as shown in the examples below:

SW2(config)#spanning-tree mode rapid-pvst

or

SW1(config)#spanning-tree mode mst

Check Contents

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the switch configuration to verify that Rapid STP has been implemented:

hostname SW2
…
…
…
spanning-tree mode rapid-pvst

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs.

If either RSTP or MSTP has not been implemented where STP is required, this is a finding.

Vulnerability Number

V-220638

Documentable

False

Rule Version

CISC-L2-000180

Severity Override Guidance

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the switch configuration to verify that Rapid STP has been implemented:

hostname SW2
…
…
…
spanning-tree mode rapid-pvst

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs.

If either RSTP or MSTP has not been implemented where STP is required, this is a finding.

Check Content Reference

M

Target Key

4070

Comments