STIGQter STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must have all disabled switch ports assigned to an unused VLAN.

DISA Rule

SV-269966r1052284_rule

Vulnerability Number

V-269966

Group Title

SRG-NET-000512-L2S-000007

Rule Version

OS10-L2S-000210

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Assign all switch ports not in use to an inactive VLAN.

Assign a VLAN interface to be unused:

OS10(config)# interface vlan 999
OS10(conf-if-vl-999)# description "Unused VLAN"
OS10(conf-if-vl-999)# shutdown
OS10(conf-if-vl-999)# exit

Assign unused switch ports to the unused VLAN:

OS10(config)# interface range eth1/1/50-1/1/58
OS10(conf-range-eth1/1/50-1/1/58)# switchport access vlan 999

Check Contents

Review the switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links.

Verify that there is a shutdown VLAN configured for unused ports:

!
interface vlan999
description "Unused VLAN"
shutdown

Verify that the unused switch ports are assigned to the inactive VLAN:

!
interface ethernet1/1/57
shutdown
switchport access vlan 999
flowcontrol receive off
!
interface ethernet1/1/58
shutdown
switchport access vlan 999
flowcontrol receive off

Verify that no trunk links are configured to accept the unused VLAN ID:

!
interface ethernet1/1/1
no shutdown
switchport mode trunk
switchport access vlan 100
flowcontrol receive off

If there are any access switch ports not in use and not in an inactive VLAN, this is a finding.

Vulnerability Number

V-269966

Documentable

False

Rule Version

OS10-L2S-000210

Severity Override Guidance

Review the switch configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links.

Verify that there is a shutdown VLAN configured for unused ports:

!
interface vlan999
description "Unused VLAN"
shutdown

Verify that the unused switch ports are assigned to the inactive VLAN:

!
interface ethernet1/1/57
shutdown
switchport access vlan 999
flowcontrol receive off
!
interface ethernet1/1/58
shutdown
switchport access vlan 999
flowcontrol receive off

Verify that no trunk links are configured to accept the unused VLAN ID:

!
interface ethernet1/1/1
no shutdown
switchport mode trunk
switchport access vlan 100
flowcontrol receive off

If there are any access switch ports not in use and not in an inactive VLAN, this is a finding.

Check Content Reference

M

Target Key

5667