Details

VTP provides central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere.

VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed (e.g., there are no access switch ports in neighboring switches belonging to such VLANs).

An attack can force a digest change for the VTP domain, enabling a rogue device to become the VTP server. This could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain being compromised.

Solution

Configure the switch to authenticate all VTP messages with a hash function using a configured password as shown in the example below:

SW1(config)#vtp password xxxxxxxxx

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_Switch_Y21M07_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Cisco.

References

• 800-53|IA-7
• CAT|II
• CCI|CCI-000803
• Rule-ID|SV-220624r539671_rule
• STIG-ID|CISC-L2-000030
• STIG-Legacy|SV-110219
• STIG-Legacy|V-101115
• Vuln-ID|V-220624

Source

• Tenable.com/audits