STIGQter: STIG Summary: Cisco NX-OS Switch L2S Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 08 May 2020:

The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

SV-110343r1_rule

Vulnerability Number

V-101239

Group Title

SRG-NET-000362-L2S-000025

Rule Version

CISC-L2-000130

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

Step 1: Enable the DHCP feature.

SW1(config)# feature dhcp

Step 2: Configure the switch to have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources as shown in the example below:

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 4,6-10

Check Contents

Step 1: Review the switch configuration and verify that DHCP snooping is enabled on a per-VLAN basis as shown in the example below:

vlan 1,4,6-10
ip dhcp snooping
…
…
…
ip dhcp snooping vlan 4,6-10

Note: Switchports assigned to a user VLAN would have drops in the area where the user community would reside; hence, the "untrusted" term is used. Server and printer VLANs would not be applicable. By default, DHCP snooping is disabled on all VLANs.

If the switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

Vulnerability Number

V-101239

Documentable

False

Rule Version

CISC-L2-000130

Severity Override Guidance

Step 1: Review the switch configuration and verify that DHCP snooping is enabled on a per-VLAN basis as shown in the example below:

vlan 1,4,6-10
ip dhcp snooping
…
…
…
ip dhcp snooping vlan 4,6-10

Note: Switchports assigned to a user VLAN would have drops in the area where the user community would reside; hence, the "untrusted" term is used. Server and printer VLANs would not be applicable. By default, DHCP snooping is disabled on all VLANs.

If the switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

Check Content Reference

M

Target Key

3551

Comments