Home
Security Hardening
DISA STIG Cisco NX OS Switch L2S V2R1

DISA STIG Cisco NX OS Switch L2S V2R1

CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – aaa group
Details Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – dot1x port-control auto
Details Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – interface dot1x
Details Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CISC-L2-000100 – The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports – BPDU Guard enabled on all user-facing or untrusted access switch ports.
Details If a rogue switch is introduced into the topology and transmits a Bridge Protocol Data Unit (BPDU) with a...
CISC-L2-000110 – The Cisco switch must have STP Loop Guard enabled.
Details The Spanning Tree Protocol (STP) loop guard feature provides additional protection against STP loops. An STP loop is created...
CISC-L2-000120 – The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.
Details Access layer switches use the Content Addressable Memory (CAM) table to direct traffic to specific ports based on the...
CISC-L2-000130 – The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources – ip dhcp snooping
Details In an enterprise network, devices under administrative control are trusted sources. These devices include the switches, routers, and servers...
CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – radius server
Details Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented...
CISC-L2-000090 – The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.
Details Spanning Tree Protocol (STP) does not provide any means for the network administrator to securely enforce the topology of...
CISC-L2-000130 – The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources – ip dhcp snooping vlan
Details In an enterprise network, devices under administrative control are trusted sources. These devices include the switches, routers, and servers...

Prev Next

DISA STIG Cisco NX OS Switch L2S V2R1

CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – aaa group

CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – dot1x port-control auto

CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – interface dot1x

CISC-L2-000100 – The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports – BPDU Guard enabled on all user-facing or untrusted access switch ports.

CISC-L2-000110 – The Cisco switch must have STP Loop Guard enabled.

CISC-L2-000120 – The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.

CISC-L2-000130 – The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources – ip dhcp snooping

CISC-L2-000080 – The Cisco switch must authenticate all endpoint devices before establishing any connection – radius server

CISC-L2-000090 – The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.

CISC-L2-000130 – The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources – ip dhcp snooping vlan