STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must have STP Loop Guard enabled on all nondesignated STP switch ports.

DISA Rule

SV-269957r1052257_rule

Vulnerability Number

V-269957

Group Title

SRG-NET-000362-L2S-000023

Rule Version

OS10-L2S-000110

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the switch to have STP Loop Guard enabled globally, or at a minimum, on all nondesignated STP switch ports.

OS10(config)# interface range ethernet 1/1/1-1/1/58
OS10(conf-range-eth1/1/1-1/1/58)# spanning-tree guard loop

Check Contents

Review the switch configuration to verify that STP Loop Guard is enabled on at least all nondesignated STP ports.

Verify that the spanning-tree guard loop setting is enabled on each interface.

interface ethernet1/1/1
no shutdown
switchport mode trunk
switchport access vlan 100
flowcontrol receive off
spanning-tree guard loop
!

If STP Loop Guard is not configured globally or on nondesignated STP ports, this is a finding.

Vulnerability Number

V-269957

Documentable

False

Rule Version

OS10-L2S-000110

Severity Override Guidance

Review the switch configuration to verify that STP Loop Guard is enabled on at least all nondesignated STP ports.

Verify that the spanning-tree guard loop setting is enabled on each interface.

interface ethernet1/1/1
no shutdown
switchport mode trunk
switchport access vlan 100
flowcontrol receive off
spanning-tree guard loop
!

If STP Loop Guard is not configured globally or on nondesignated STP ports, this is a finding.

Check Content Reference

M

Target Key

5667