Free DISA STIG and SRG Library | Vaulted

V-101115

The Cisco switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

Finding ID
CISC-L2-000030
Rule ID
SV-110219r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000168-L2S-000019
CCI
CCI-000803
Target Key
(None)
Documentable
No
Discussion

VTP provides central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed (e.g., there are no access switch ports in neighboring switches belonging to such VLANs). An attack can force a digest change for the VTP domain, enabling a rogue device to become the VTP server. This could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain being compromised.

Fix Text

Configure the switch to authenticate all VTP messages with a hash function using a configured password as shown in the example below: SW1(config)#vtp password xxxxxxxxx

Check Content

Review the switch configuration to verify that VTP is enabled using the show vtp status command as shown in the example below: Switch#show vtp status VTP Version capable : 1 to 3 VTP version running : 1 VTP Domain Name : VTP Pruning Mode : Disabled VTP Traps Generation : Disabled Device ID : 5e00.0000.8000 Feature VLAN: -------------- VTP Operating Mode : Off Maximum VLANs supported locally : 1005 Number of existing VLANs : 5 Configuration Revision : 0 MD5 digest : 0x57 0xCD 0x40 0x65 0x63 0x59 0x47 0xBD 0x56 0x9D 0x4A 0x3E 0xA5 0x69 0x35 0xBC Switch# If mode is set to anything other than off, verify that a password has been configured using the show vtp password command. Note: VTP authenticates all messages using an MD5 hash that consists of the VTP version plus the VTP Password plus VTP Domain plus VTP Configuration Revision. If VTP is enabled on the switch and is not authenticating VTP messages with a hash function using a configured password, this is a finding.