STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Layer 2 Switch Security Requirements Guide

V-206664

CAT II (Medium)

The layer 2 switch must be configured to protect against one-way connections.

Rule ID

SV-206664r1188389_rule

STIG

Layer 2 Switch Security Requirements Guide

Version

V3R4

CCIs

CCI-000366

Discussion

Physical misconfiguration of network ports can cause network instability for protocols such as STP. In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. Although more common in fiber connections, it can occur in misconfigured copper cables. Features such as Unidirectional Link Detection (UDLD) are layer 2 protocols that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Vendors may have different names for similar features. Ports configured with these features enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down. Note: UDLD is a Cisco-proprietary protocol. However, other switch vendors, such as 3Com, Extreme, and D-Link, have similar functionality in their products, respectively: Device Link Detection Protocol (DLDP), Extreme Link Status Monitoring (ELSM), and D-Link Unidirectional Link Detection (DULD).

Check Content

If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that features such as Unidirectional Link Detection are enabled globally or on a per interface basis to protect against one-way connections. Doing so may also identify misconfigured copper cables. 

If the switch has fiber optic interconnections with neighbors and is not configured to protect against one-way connections, this is a finding.

Fix Text

Configure the switch globally or per interface to protect against one-way connections.