STIGQter: STIG Summary: Cisco IOS XE Switch L2S Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

SV-220659r539671_rule

Vulnerability Number

V-220659

Group Title

SRG-NET-000362-L2S-000025

Rule Version

CISC-L2-000130

Severity

CAT II

CCI(s)

CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

Fix Recommendation

Configure the switch to have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources as shown in the example below:

SW2(config)#ip dhcp snooping
SW2(config)#ip dhcp snooping vlan 2,4-8,11

Check Contents

Review the switch configuration and verify that DHCP snooping is enabled on all user VLANs as shown in the example below:

hostname SW2
…
…
…
ip dhcp snooping vlan 2,4-8,11
ip dhcp snooping

Note: Switchports assigned to a user VLAN would have drops in the area where the user community would reside; hence, the "untrusted" term is used. Server and printer VLANs would not be applicable.

If the switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments