V-255985

Discussion

VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch that the victim is connected to. If the attacker knows the victim’s MAC address, it can forge a frame with two 802.1q tags and a layer 2 header with the destination address of the victim. Since the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to the victim’s switch will simply remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame on to the trunk link unaware of the inner tag with a VLAN ID of which the victim’s switch port is a member.

Check Content

Review the Arista MLS switch configuration for all trunk ports to have a unique native VLAN ID that is not the default VLAN 1 by using the following example:

switch(config)#sh run | sec native vlan
interface Ethernet4
   description STIG Disable_VLAN 1 and native vlan to 1000
   switchport trunk native vlan 1000
   switchport trunk allowed vlan 2-4094

If the native VLAN has the same VLAN ID as the default VLAN, this is a finding.