STIGQter STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must have IGMP or MLD Snooping configured on all VLANs

DISA Rule

SV-269963r1052275_rule

Vulnerability Number

V-269963

Group Title

SRG-NET-000512-L2S-000002

Rule Version

OS10-L2S-000170

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.

Enable IGMP or MLD snooping globally:

OS10(config)# ip igmp snooping enable
OS10(config)# ipv6 mld snooping enable

Enable IGMP or MLD snooping on each VLAN:

OS10(config)# interface vlan 100
OS10(conf-if-vl-100)# ip igmp snooping
OS10(conf-if-vl-100)# ipv6 mld snooping

Check Contents

Review the Dell OS10 Switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic, respectively.

Verify that IGMP and MLD snooping have not been disabled globally by checking that the following have not been configured:

no ip igmp snooping enable
no ipv6 mld snooping enable

Verify that IGMP or MLD snooping have not been disabled on any of the individual VLANs:

Interface vlan 100
no ip igmp snooping
no ipv6 mld snooping

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-269963

Documentable

False

Rule Version

OS10-L2S-000170

Severity Override Guidance

Review the Dell OS10 Switch configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic, respectively.

Verify that IGMP and MLD snooping have not been disabled globally by checking that the following have not been configured:

no ip igmp snooping enable
no ipv6 mld snooping enable

Verify that IGMP or MLD snooping have not been disabled on any of the individual VLANs:

Interface vlan 100
no ip igmp snooping
no ipv6 mld snooping

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

5667