STIGQter: STIG Summary: Cisco IOS Switch L2S Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 01 Jul 2026:

The Cisco switch must not use the default VLAN for management traffic.

DISA Rule

SV-220644r991852_rule

Vulnerability Number

V-220644

Group Title

SRG-NET-000512-L2S-000010

Rule Version

CISC-L2-000240

Severity

CAT II

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Configure the switch for management access to use a VLAN other than the default VLAN:

SW1(config)#int vlan 22
SW1(config-if)#ip add 10.1.22.3 255.255.255.0
SW1(config-if)#no shut

Check Contents

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it:

SW1#show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Gi0/2 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-998,1000-4094
Gi0/2 1-4094

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Vulnerability Number

V-220644

Documentable

False

Rule Version

CISC-L2-000240

Severity Override Guidance

Review the switch configuration and verify that the default VLAN is pruned from trunk links that do not require it:

SW1#show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Gi0/2 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-998,1000-4094
Gi0/2 1-4094

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Check Content Reference

M

Target Key

4070