STIGQter STIGQter: STIG Summary: Cisco NX OS Switch L2S Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Jul 2026:

The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

DISA Rule

SV-220689r1188389_rule

Vulnerability Number

V-220689

Group Title

SRG-NET-000512-L2S-000004

Rule Version

CISC-L2-000190

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the switch to enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

SW1(config)# feature udld

Check Contents

If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that either UDLD is enabled globally or not explicitly disabled on a per interface basis as shown in the examples below.

hostname SW1
…
…
…
feature udld

or

interface GigabitEthernet0/3
udld disabled

Note: By default, UDLD is enabled on all interfaces with fiber optic connections. An alternative implementationwhen UDLD is not supported by connected device is to deploy a single member Link Aggregation Group (LAG) via IEEE 802.3ad Link Aggregation Control Protocol (LACP).

If the switch has fiber optic interconnections with neighbors and UDLD is not enabled, this is a finding.

Vulnerability Number

V-220689

Documentable

False

Rule Version

CISC-L2-000190

Severity Override Guidance

If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that either UDLD is enabled globally or not explicitly disabled on a per interface basis as shown in the examples below.

hostname SW1
…
…
…
feature udld

or

interface GigabitEthernet0/3
udld disabled

Note: By default, UDLD is enabled on all interfaces with fiber optic connections. An alternative implementationwhen UDLD is not supported by connected device is to deploy a single member Link Aggregation Group (LAG) via IEEE 802.3ad Link Aggregation Control Protocol (LACP).

If the switch has fiber optic interconnections with neighbors and UDLD is not enabled, this is a finding.

Check Content Reference

M

Target Key

4073