STIGQter: STIG Summary: Cisco NX OS Switch L2S Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

SV-220684r856493_rule

Vulnerability Number

V-220684

Group Title

SRG-NET-000362-L2S-000025

Rule Version

CISC-L2-000130

Severity

CAT II

CCI(s)

CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

Fix Recommendation

Step 1: Enable the DHCP feature.

SW1(config)# feature dhcp

Step 2: Configure the switch to have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources as shown in the example below:

SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 4,6-10

Check Contents

Step 1: Review the switch configuration and verify that DHCP snooping is enabled on a per-VLAN basis as shown in the example below:

vlan 1,4,6-10
ip dhcp snooping
…
…
…
ip dhcp snooping vlan 4,6-10

Note: Switchports assigned to a user VLAN would have drops in the area where the user community would reside; hence, the "untrusted" term is used. Server and printer VLANs would not be applicable. By default, DHCP snooping is disabled on all VLANs.

If the switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key