STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must enable Far-End Failure Detection (FEFD) to protect against one-way connections.

DISA Rule

SV-269965r1052281_rule

Vulnerability Number

V-269965

Group Title

SRG-NET-000512-L2S-000004

Rule Version

OS10-L2S-000190

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure the OS10 switch to enable FEFD on appropriate interfaces connected to other OS10 peers.

OS10(config)# interface ethernet 1/1/6
OS10(conf-if-eth1/1/6)# fefd mode normal

Check Contents

Dell OS10 provides a proprietary protocol, FEFD, to protect against one-way connections.

Verify that FEFD is configured on the appropriate ethernet interfaces by reviewing the FEFD status to verify the desired interfaces are in mode Normal or Aggressive.

OS10# show fefd
FEFD is globally 'OFF', interval is 15 seconds.
INTERFACE MODE INTERVAL STATE
============================================================
eth1/1/1 NA NA Idle (Not running)
eth1/1/2 NA NA Idle (Not running)
eth1/1/3 NA NA Idle (Not running)
eth1/1/4 NA NA Idle (Not running)
eth1/1/5 NA NA Idle (Not running)
eth1/1/6 Normal 15 Unknown
eth1/1/7 Aggressive 15 Unknown
eth1/1/8 NA NA Idle (Not running)
…

If FEFD is not configured on the appropriate interfaces, this is a finding.

The Dell OS10 Switch must enable Far-End Failure Detection (FEFD) to protect against one-way connections.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key