← Back to Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide

V-269967

CAT II (Medium)

The Dell OS10 Switch must not have the default VLAN assigned to any host-facing switch ports.

Rule ID

SV-269967r1052287_rule

STIG

Dell OS10 Switch Layer 2 Switch Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

In a VLAN-based network, switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. Therefore, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

Check Content

Review the switch configurations and verify that no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1). VLAN assignments can be verified via the “show vlan” command:

OS10# show vlan
Codes: * - Default VLAN, M - Management VLAN, R - Remote Port Mirroring VLANs,
       @ - Attached to Virtual Network, P - Primary, C - Community, I - Isolated,
       S - VLAN-Stack VLAN
Q: A - Access (Untagged), T - Tagged
    NUM    Status    Description                     Q Ports
*   1      Inactive
    30     Inactive  Management VLAN
    100    Inactive                                  A Eth1/1/1
    200    Inactive                                  A Eth1/1/3-1/1/58
    201    Inactive                                  A Eth1/1/2
OS10#

If there are access switch ports assigned to the default VLAN, this is a finding.

Fix Text

Remove the assignment of the default VLAN from all access switch ports:

OS10(config)# interface range eth1/1/4-1/1/58
OS10(conf-range-eth1/1/4-1/1/58)# switchport mode access
OS10(conf-range-eth1/1/4-1/1/58)# switchport access vlan 200