STIGQter: STIG Summary: HP FlexFabric Switch L2S Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The HP FlexFabric Switch must have the default VLAN pruned from all trunk ports that do not require it.

DISA Rule

SV-80579r1_rule

Vulnerability Number

V-66089

Group Title

SRG-NET-000512-L2S-000009

Rule Version

HFFS-L2-000026

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Remove the native vlan from trunks that do not require it.

[HP-interface GigabitEthernet1/0/1] undo port trunk permit vlan 1

Check Contents

Review the HP FlexFabric Switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

<HP>display vlan 1

VLAN ID: 1
VLAN type: Static
Route interface: Configured
Description: VLAN 0001
Name: VLAN 0001
Tagged ports: None
Untagged ports:
GigabitEthernet1/0/1 GigabitEthernet1/0/2
GigabitEthernet1/0/3 GigabitEthernet1/0/4
GigabitEthernet1/0/5 GigabitEthernet1/0/6
GigabitEthernet1/0/7 GigabitEthernet1/0/8

Vulnerability Number

V-66089

Documentable

False

Rule Version

HFFS-L2-000026

Severity Override Guidance

Review the HP FlexFabric Switch configuration and verify that the default VLAN is pruned from trunk links that do not require it.

If the default VLAN is not pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

<HP>display vlan 1

VLAN ID: 1
VLAN type: Static
Route interface: Configured
Description: VLAN 0001
Name: VLAN 0001
Tagged ports: None
Untagged ports:
GigabitEthernet1/0/1 GigabitEthernet1/0/2
GigabitEthernet1/0/3 GigabitEthernet1/0/4
GigabitEthernet1/0/5 GigabitEthernet1/0/6
GigabitEthernet1/0/7 GigabitEthernet1/0/8

Check Content Reference

M

Target Key

2977

Comments