STIGQter: STIG Summary: HP FlexFabric Switch L2S Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

HP FlexFabric Switch must authenticate all network-connected endpoint devices before establishing any connection.

DISA Rule

SV-80541r1_rule

Vulnerability Number

V-66051

Group Title

SRG-NET-000343-L2S-000016

Rule Version

HFFS-L2-000002

Severity

CAT I

CCI(s)

• CCI-001958 - The information system authenticates an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.

Weight

10

Fix Recommendation

Configure 802.1 x authentications on all host-facing access switch ports. To authenticate those devices that do not support 802.1x, MAC Authentication Bypass must be configured.

[HP] dot1x
[HP] dot1x authentication-method eap
[HP] domain radius jitc
[HP] radius scheme jitc
[HP-radius-jitc]radius scheme jitc
[HP-radius-jitc]primary authentication 15.252.76.124
[HP-radius-jitc]primary accounting 15.252.76.124
[HP-radius-jitc]accounting-on enable
[HP-radius-jitc]key authentication simple test123
[HP-radius-jitc]user-name-format without-domain
[HP-radius-jitc]nas-ip 15.252.78.99
[HP]domain jitc
[HP-isp-jitc]domain jitc
[HP-isp-jitc]authentication lan-access radius-scheme jitc
[HP-isp-jitc]authorization lan-access radius-scheme jitc
[HP] interface gigbitethernet 1/0/1
[HP-Gigabitethernet1/0/1] undo dot1x handshake
dot1x mandatory-domain jitc
undo dot1x multicast-trigger

Check Contents

Verify all access switch ports connecting to LAN outlets are configured for 802.1x or MAC authentication as shown in these configuration examples.

802.1x example:

interface Ten-GigabitEthernet1/0/4
port link-mode bridge
port access vlan 200
dot1x

MAC authentication example:

interface Ten-GigabitEthernet1/0/5
port link-mode bridge
port access vlan 200
mac-authentication

If all access switch ports connecting to LAN outlets are not configured for 802.1x or MAC authentication, this is a finding.

Vulnerability Number

V-66051

Documentable

False

Rule Version

HFFS-L2-000002

Severity Override Guidance

Verify all access switch ports connecting to LAN outlets are configured for 802.1x or MAC authentication as shown in these configuration examples.

802.1x example:

interface Ten-GigabitEthernet1/0/4
port link-mode bridge
port access vlan 200
dot1x

MAC authentication example:

interface Ten-GigabitEthernet1/0/5
port link-mode bridge
port access vlan 200
mac-authentication

If all access switch ports connecting to LAN outlets are not configured for 802.1x or MAC authentication, this is a finding.

Check Content Reference

M

Target Key

2977

Comments