← Back to Cisco NX OS Switch RTR Security Technical Implementation Guide

V-221123

CAT II (Medium)

The Cisco PE switch providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

Rule ID

SV-221123r999732_rule

STIG

Cisco NX OS Switch RTR Security Technical Implementation Guide

Version

V3R4

CCIs

CCI-001095

Discussion

A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.

Check Content

Review the switch configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS as shown in the example below:

interface Ethernet2/4
 no shutdown
 no switchport
 storm-control broadcast level 40.00
 service instance 1 ethernet
 encapsulation dot1q 100

If storm control is not enabled at a minimum for broadcast traffic, this is a finding.

Fix Text

Configure storm control for each CE-facing interface as shown in the example below:

SW1(config)# int e2/4
SW1(config-if)# storm-control broadcast level 40 
SW1(config-if)# end