Check: CISC-L2-000190
Cisco NX OS Switch L2S STIG:
CISC-L2-000190
(in versions v2 r3 through v2 r2)
Title
The Cisco switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections. (Cat II impact)
Discussion
In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. When such a physical misconfiguration occurs, protocols such as STP can cause network instability. UDLD is a layer 2 protocol that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Ports with UDLD enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down.
Check Content
If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that either UDLD is enabled globally or not explicitly disabled on a per interface basis as shown in the examples below. hostname SW1 … … … feature udld or interface GigabitEthernet0/3 udld disabled Note: By default, UDLD is enabled on all interfaces with fiber optic connections. An alternative implementationwhen UDLD is not supported by connected device is to deploy a single member Link Aggregation Group (LAG) via IEEE 802.3ad Link Aggregation Control Protocol (LACP). If the switch has fiber optic interconnections with neighbors and UDLD is not enabled, this is a finding.
Fix Text
Configure the switch to enable Unidirectional Link Detection (UDLD) to protect against one-way connections. SW1(config)# feature udld
Additional Identifiers
Rule ID: SV-220689r917685_rule
Vulnerability ID: V-220689
Group Title: SRG-NET-000512-L2S-000004
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |