← Back to Layer 2 Switch Security Requirements Guide

V-206648

CAT II (Medium)

When using VLAN Trunk Protocol (VTP) or similar features, the layer 2 switch must authenticate all VTP messages with a hash function using the most secured cryptographic algorithm available.

Rule ID

SV-206648r1188386_rule

STIG

Layer 2 Switch Security Requirements Guide

Version

V3R4

CCIs

CCI-000803

Discussion

VTP or other similarly named vendor features, provide central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed; that is, there are no access switch ports in neighboring switches belonging to such VLANs. An attack can force a digest change for the VTP domain enabling a rogue device to become the VTP server, which could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain's being compromised.

Check Content

Review the switch configuration to verify if VTP or (similarly named vendor features) is enabled. If VTP is enabled, verify that authentication has been configured.

If VTP has been configured on the switch and is not authenticating VTP messages with a hash function using the most secured cryptographic algorithm available, this is a finding.

Fix Text

Configure the switch to authenticate all VTP (or similarly named vendor feature) messages with a hash function using the most secured cryptographic algorithm available.