STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 5 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Layer 2 Switch Security Requirements Guide

V-206663

CAT II (Medium)

The layer 2 switch must implement Rapid STP where VLANs span multiple switches with redundant links.

Rule ID

SV-206663r385561_rule

STIG

Layer 2 Switch Security Requirements Guide

Version

V3R4

CCIs

CCI-000366

Discussion

Spanning Tree Protocol (STP) is implemented on bridges and switches to prevent layer 2 loops when a broadcast domain spans multiple bridges and switches and when redundant links are provisioned to provide high availability in case of link failures. Convergence time can be significantly reduced using Rapid STP (802.1w) instead of STP (802.1d), resulting in improved availability. Rapid STP should be deployed by implementing either Rapid Per-VLAN-Spanning-Tree (Rapid-PVST) or Multiple Spanning-Tree Protocol (MSTP), the latter scales much better when there are many VLANs.

Check Content

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology.  If STP is required, then review the switch configuration to verify that Rapid STP has been implemented. 

If Rapid STP has not been implemented where STP is required, this is a finding.

Fix Text

Configure Rapid STP to be implemented at the access and distribution layers where VLANs span multiple switches.