Free DISA STIG and SRG Library | Vaulted

V-62197

The layer 2 switch must have all trunk links enabled statically.

Finding ID
SRG-NET-000512-L2S-000005
Rule ID
SV-76687r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-NET-000512
CCI
CCI-000366
Target Key
(None)
Documentable
No
Discussion

When trunk negotiation is enabled via Dynamic Trunk Protocol (DTP), considerable time can be spent negotiating trunk settings (802.1q or ISL) when a node or interface is restored. While this negotiation is happening, traffic is dropped because the link is up from a layer 2 perspective. Packet loss can be eliminated by setting the interface statically to trunk mode, thereby avoiding dynamic trunk protocol negotiation and significantly reducing any outage when restoring a failed link or switch.

Fix Text

Configure the switch to enable trunk links statically.

Check Content

Review the switch configuration to verify that trunk negotiation is disabled by statically configuring all trunk links. Configuring a command to manually disable negotiation may also be required for some switch platforms. If trunk negotiation is enabled on any interface, this is a finding.