STIGQter: STIG Summary: Cisco NX OS Switch L2S Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

DISA Rule

SV-220685r1156799_rule

Vulnerability Number

V-220685

Group Title

SRG-NET-000362-L2S-000026

Rule Version

CISC-L2-000140

Severity

CAT II

CCI(s)

CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

Fix Recommendation

Configure the switch to have IP Source Guard enabled on all user-facing or untrusted access switch ports.

SW1(config)# int e1/1-32
SW1(config-if-range)# ip verify source dhcp-snooping-vlan

Check Contents

Review the switch configuration to verify IP Source Guard is enabled on all user-facing or untrusted access switch ports as shown in the example below:

interface Ethernet1/1
ip verify source dhcp-snooping-vlan

interface Ethernet1/2
ip verify source dhcp-snooping-vlan
…
…
…
interface Ethernet1/32
ip verify source dhcp-snooping-vlan

Note: The IP Source Guard feature depends on the entries in the DHCP snooping database or static IP-MAC-VLAN configuration commands to verify IP-to-MAC address bindings.

Note: This requirement is not applicable for switch ports configured for 802.1x or Mac Address Bypass.

If the switch does not have IP Source Guard enabled on all untrusted access switch ports, this is a finding.

The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key