V-269972

Discussion

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command-and-control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. Satisfies: SRG-NET-000715-L2S-000120, SRG-NET-000512-L2S-000012

Check Content

Review the switch configurations and verify that no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1). VLAN assignments can be verified via the “show vlan” command:

OS10# show vlan
Codes: * - Default VLAN, M - Management VLAN, R - Remote Port Mirroring VLANs,
       @ - Attached to Virtual Network, P - Primary, C - Community, I - Isolated,
       S - VLAN-Stack VLAN
Q: A - Access (Untagged), T - Tagged
    NUM    Status    Description                     Q Ports
*   1      Inactive
    30     Inactive  Management VLAN
    100    Inactive                                  A Eth1/1/1
    200    Inactive                                  A Eth1/1/3-1/1/58
    201    Inactive                                  A Eth1/1/2
OS10#

If there are access switch ports assigned to the default VLAN, this is a finding.