Title

The Cisco ACI layer 2 switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections. (Cat II impact)

Discussion

In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. When such a physical misconfiguration occurs, protocols such as STP can cause network instability. UDLD is a layer 2 protocol that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Ports with UDLD enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down.

Check Content

If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that either UDLD is enabled globally or not explicitly disabled on a per interface basis as shown in the example below: show udld <interface> If the switch has fiber optic interconnections with neighbors and UDLD is not enabled, this is a finding.

Fix Text

Configure the switch to enable UDLD to protect against one-way connections: APIC1(config)# udld enable

Additional Identifiers

Rule ID: SV-272040r1064443_rule

Vulnerability ID: V-272040

Group Title: SRG-NET-000512-L2S-000004

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.