STIGQter STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must implement Rapid Spanning Tree Protocol (STP) where VLANs span multiple switches with redundant links.

DISA Rule

SV-269964r1052278_rule

Vulnerability Number

V-269964

Group Title

SRG-NET-000512-L2S-000003

Rule Version

OS10-L2S-000180

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure Rapid STP or MSTP to be implemented at the access and distribution layers where VLANs span multiple switches as shown in the examples below:

OS10(config)# spanning-tree mode rstp

or

OS10(config)# spanning-tree mode mst

Check Contents

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, then review the switch configuration to verify that Rapid STP has been implemented.

OS10# show running-configuration
...
...
spanning-tree mode rstp

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support many VLANs.

OS10# show running-configuration
...
...
spanning-tree mode mst

If Rapid STP or MSTP have not been implemented where STP is required, this is a finding.

Vulnerability Number

V-269964

Documentable

False

Rule Version

OS10-L2S-000180

Severity Override Guidance

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, then review the switch configuration to verify that Rapid STP has been implemented.

OS10# show running-configuration
...
...
spanning-tree mode rstp

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support many VLANs.

OS10# show running-configuration
...
...
spanning-tree mode mst

If Rapid STP or MSTP have not been implemented where STP is required, this is a finding.

Check Content Reference

M

Target Key

5667