Check: CISC-L2-000160
Cisco NX OS Switch L2S STIG:
CISC-L2-000160
(in versions v2 r3 through v1 r0.1)
Title
The Cisco switch must have Storm Control configured on all host-facing switchports. (Cat III impact)
Discussion
A traffic storm occurs when packets flood a LAN, creating excessive traffic and degrading network performance. Traffic storm control prevents network disruption by suppressing ingress traffic when the number of packets reaches a configured threshold levels. Traffic storm control monitors ingress traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.
Check Content
Review the switch configuration to verify that storm control is enabled on all host-facing interfaces as shown in the example below: interface GigabitEthernet0/3 switchport access vlan 12 storm-control unicast unicast level 50.00 storm-control broadcast broadcast level 40 If storm control is not enabled at a minimum for broadcast traffic, this is a finding.
Fix Text
Configure storm control for each host-facing interface as shown in the example below: SW1(config)#int range e0/2 – 8 SW1(config-if-range)# storm-control unicast level 50 SW1(config-if-range)# storm-control broadcast level 40
Additional Identifiers
Rule ID: SV-220687r539671_rule
Vulnerability ID: V-220687
Group Title: SRG-NET-000512-L2S-000001
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |