STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must uniquely identify all network-connected endpoint devices before establishing any connection.

DISA Rule

SV-269953r1052245_rule

Vulnerability Number

V-269953

Group Title

SRG-NET-000148-L2S-000015

Rule Version

OS10-L2S-000020

Severity

CAT I

CCI(s)

• CCI-000778 - Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.
• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Configure 802.1 x authentications on all host-facing access switch ports.

Configure RADIUS for 802.1x authentication:

OS10(config)# radius-server host 10.10.1.200 key my-shared-secret
OS10(config)# radius-server retransmit 10
OS10(config)# radius-server timeout 10

Enable 802.1X globally in CONFIGURATION mode:

OS10(config)# dot1x system-auth-control

Enable 802.1x on the host-facing access interfaces:

OS10(config)# interface range ethernet 1/1/2-1/1/48
OS10(conf-rangeeth1/1/2-1/1/48)# dot1x port-control auto
OS10(conf-rangeeth1/1/2-1/1/48)# dot1x re-authentication

Check Contents

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms.

Verify that 802.1x authentication is enabled globally by reviewing the configuration for the presence of:

dot1x system-auth-control

Verify that 802.1x authentication is enabled on the host-facing access interfaces by looking for the following two dot1x settings:
!
interface ethernet1/1/3
dot1x port-control auto
dot1x re-authentication

If 802.1x authentication is not on configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.

Vulnerability Number

V-269953

Documentable

False

Rule Version

OS10-L2S-000020

Severity Override Guidance

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms.

Verify that 802.1x authentication is enabled globally by reviewing the configuration for the presence of:

dot1x system-auth-control

Verify that 802.1x authentication is enabled on the host-facing access interfaces by looking for the following two dot1x settings:
!
interface ethernet1/1/3
dot1x port-control auto
dot1x re-authentication

If 802.1x authentication is not on configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.

Check Content Reference

M

Target Key

5667