STIGQter STIGQter: STIG Summary: Cisco IOS XE Switch L2S Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco switch must have IGMP or MLD Snooping configured on all VLANs.

DISA Rule

SV-220663r539671_rule

Vulnerability Number

V-220663

Group Title

SRG-NET-000512-L2S-000002

Rule Version

CISC-L2-000170

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively globally.

SW1(config)#ip igmp snooping

Check Contents

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively. The example below are the steps to verify that IGMP snooping is enabled for each VLAN.

Step 1: Verify that IGMP or MLD snooping is enabled globally. By default, IGMP snooping is enabled globally; hence, the following command should not be in the switch configuration:

no ip igmp snooping

Step 2: Verify that IGMP snooping is not disabled for any VLAN as shown in the example below:

no ip igmp snooping vlan 11

Note: When globally enabled, it is also enabled by default on all VLANs, but can be disabled on a per-VLAN basis. If global snooping is disabled, VLAN snooping cannot be enabled.

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-220663

Documentable

False

Rule Version

CISC-L2-000170

Severity Override Guidance

Review the switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively. The example below are the steps to verify that IGMP snooping is enabled for each VLAN.

Step 1: Verify that IGMP or MLD snooping is enabled globally. By default, IGMP snooping is enabled globally; hence, the following command should not be in the switch configuration:

no ip igmp snooping

Step 2: Verify that IGMP snooping is not disabled for any VLAN as shown in the example below:

no ip igmp snooping vlan 11

Note: When globally enabled, it is also enabled by default on all VLANs, but can be disabled on a per-VLAN basis. If global snooping is disabled, VLAN snooping cannot be enabled.

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

4071

Comments