STIGQter: STIG Summary: Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must have the default VLAN pruned from all trunk ports that do not require it.

DISA Rule

SV-269968r1052290_rule

Vulnerability Number

V-269968

Group Title

SRG-NET-000512-L2S-000009

Rule Version

OS10-L2S-000230

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Best practice for VLAN-based networks is to prune unnecessary trunk links from gaining access to the default VLAN, and to ensure that frames belonging to the default VLAN do not traverse trunks not requiring frames from the VLAN:

OS10(config)# interface ethernet 1/1/1
OS10(conf-if-eth1/1/1)# switchport access vlan 99
OS10(conf-if-eth1/1/1)# switchport trunk allowed vlan 2100-2102

Check Contents

Review the OS10 switch configuration and verify that the default VLAN is pruned from the allowed VLANs on trunk links that do not require it:

interface ethernet 1/1/1
no shutdown
switchport mode trunk
switchport access vlan 99
switchport trunk allowed vlan 2100-2102

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Vulnerability Number

V-269968

Documentable

False

Rule Version

OS10-L2S-000230

Severity Override Guidance

Review the OS10 switch configuration and verify that the default VLAN is pruned from the allowed VLANs on trunk links that do not require it:

interface ethernet 1/1/1
no shutdown
switchport mode trunk
switchport access vlan 99
switchport trunk allowed vlan 2100-2102

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

Check Content Reference

M

Target Key

5667