What changed in Cisco ACI Layer 2 Switch STIG V1R2V1R2 changes

Check text

Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication Bypass (MAB) must be configured on those switch ports connected to devices that do not support an 802.1x supplicant. 1. Navigate to Fabric >> PortAccess ProfilesPolicies >> Interfaces >> Leaf Interfaces >> Policy Groups >> (Leaf Access port, PC interface or VPC interface) >> {{your_policy_name}} >> Advance Policies. 2. Select the port profile that is used for host-facing access ports. 3. Within the port profile configuration, locate the 802.1x settings and verify 802.1x is and MAB are enabled. 4. Navigate to the Endpoints section. 5. Choose the leaf nodes that host the host-facing ports and verify the port profile is applied. Verify the policy group is assigned to an interface: Fabric >> Access Policies >> Interfaces >> Leaf Interfaces >> Profiles >> {{your_profile}}. If 802.1x authentication or MAB is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.

Fix text

Enable 802.1X authentication on host-facing access ports in Cisco APIC and accommodate devices lacking 802.1X support, configure MAB (MAC Authentication Bypass). The following is an example. Enable 802.1x on Port Profiles: 1. Navigate to Fabric >> PortAccess ProfilesPolicies >> Interfaces >> Leaf Interfaces >> Policy Groups >> (Leaf Access port, PC interface or VPC interface) >> {{your_policy_name}} >> Advance Policies. 2. Select the port profile that is used for host-facing access ports. 3. Within the port profile configuration, locate the 802.1x settings and enable it. 4. Specify the 802.1x authentication parameters are set. 5. Enable MAB and specify the MAC address range and relevant settings. 6. For Host Mode, select "Single Host". 7. The MAC Auth should be EAP_FALLBACK_MAB. 8. In the Failed-auth VLAN field, select the VLAN to deploy to if authentication failed. 9. In the Failed-auth EPG field, choose the tenant, application profile, or EPG to deploy to if authentication failed. 10. Go to the Endpoints section. 11. Choose the leaf nodes that host the host-facing ports. 12. Apply the configured port profile to the host-facing ports. Apply the policy group to an interface: Fabric >> Access Policies >> Interfaces >> Leaf Interfaces >> Profiles >> {{your_profile}}.

V-272029 in V1R2

Check text

Verify the switch configurationauthenticates has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJnetwork-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication Bypass (MAB) must be configured on those switch ports connected toendpoint devices thatbefore doestablishing notany support an 802connection.1x supplicant. Verify the 802.1X Port Authentication policy is configured correctly: 1. On the menu bar, click Fabric >> External Access Policies >> PoliciesInterfaces >> InterfaceLeaf Interfaces >> 802.1X Port Authentication. 2. Right-click "802.1X Port Authentication" and review each 802.1X Port Authentication Policy. - InGroups the Host Mode field, verify "Single Host" is selected. - In the MAC Auth field, verify "EAP_FALLBACK_MAB" is selected. Verify 802.1X Node Authentication is associated with the 802.1X Port Authentication Policy to a Fabric Access Group: 1. On the menu bar, click Fabric >> External(Leaf Access Policies >> Policies >> Switch >> 802.1X Node Authentication. 2. Right-click "802.1X Node Authentication" and review each 802.1X Node Authentication Policy. - In the Failed-auth EPG fieldport, verifyPC theinterface tenant,or applicationVPC profile,interface) and EPG to deploy to in the case of failed authentication is configured. - In the Failed-auth VLAN. verify the VLAN to deploy to in the case of failed authentication is selected. Verify the 802.1X Node Authentication Policy is applied to each Leaf Switch Policy Group: 1. Navigate to Fabric >> External{{your_policy_name}} Access Policies >> SwitchesAdvance >> Leaf Switches >> Policy GroupsPolicies. 2. Right-clickPath "Policy Groups" to inspectValidate each Access Switch Policy Group. Verify the 802.1Xpolicy Nodegroup Authenticationis Policyassigned to aan Leaf Interface Profileinterface: 1. Navigate to Fabric >> External Access Policies >> Interfaces >> Leaf Interfaces >> Profiles. 2. Right-click>> "Profiles" and select Leaf Interface Profile{{your_profile}}. 3. Expand the Interface Selectors table to review the Access Port Selector(s). If 802.1xThe authenticationCisco orACI MABlayer is2 not configured on all access switch portsdoes connectingnot toauthenticate LANall outletsnetwork-connected orendpoint devices notbefore locatedestablishing inany the telecom roomconnection, wiring closets, or equipment rooms, this is a finding.

Fix text

ConfigureCreate 802.1Authentication xPolicy authenticationsand onassociate allwith host-facing access switch ports. To authenticate those devices that do not support 802.1x, MAB must be configured. When configuring the interface for a leaf switch, the port security policy can be chosen from the list of available port security policiesgroup. Create an 802.1X Port Authentication Policy: 1. On the menu bar, click Fabric >> External Access Policies >> PoliciesInterfaces >> InterfaceLeaf Interfaces >> 802.1X Port Authentication. 2. Right-click "802.1X Port Authentication" to open Create 802.1X Port Authentication Policy andGroups fill>> out(Leaf theAccess form. - In the Host Mode field, select "Single Host—For allowing only one host per port". - In the MAC Auth field, selectPC "EAP_FALLBACK_MAB". -interface Clickor "Submit". ConfigureVPC 802.1Xinterface) Node Authentication. Associate the 802.1X Port Authentication Policy to a Fabric Access Group: 1. On the menu bar, click Fabric >> External{{your_policy_name}} Access Policies >> PoliciesAdvance >> Switch >> 802Policies.1X Node Authentication. - Right-click "802.1X Node Authentication" to open Create 802.1X Node Authentication Policy. - In the Failed-auth EPG field, select the tenant, application profile, and EPG to deploy to in the case of failed authentication. - In the Failed-auth VLAN, select the VLAN to deploy to in the case of failed authentication. 2. ToPath associate the 802.1X Node Authentication Policy to aValidate Leaf Switch Policy Group, navigate to Fabric >> External Access Policies >> Switches >> Leaf Switches >> Policy Groups. - Right-click "Policy Groups" to open Create Access Switch Policy Group. - In the 802.1X Node Authentication Policy field, select the previously created policy. - Clickgroup "Submit". 3.is Toassigned associate the 802.1X Node Authentication Policy to aan Leafinterface: Interface Profile, navigate to Fabric >> External Access Policies >> Interfaces >> Leaf Interfaces >> Profiles. - Right-click>> "Profiles" to open Create Leaf Interface Profile{{your_profile}}. - Expand the Interface Selectors table to open the Create Access Port Selector dialog box and fill out the form. - In the Interface Policy Group field, select the previously created policy and click "OK". - Click "Submit".

Discussion

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. For distributed architectures (e.g., service-oriented architectures [SOA]), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions. This requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers ([outside a datacenter)], VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.

V-272032 in V1R2

Check text

Verify each Bridge Domain used is configured to block unknown unicast traffic. 1. Navigate to Tenant >> Networking >> Bridge Domains >> Policy >> General and inspect each Tenant's Bridge Domain configuration. 2. Expand Networking and right-click each Bridge Domain. - Verify the L2 Unknown Unicast box is set to "Hardware Proxy". If any user-facing or untrusted access switch ports do not have UUFB set to "Hardware Proxy", this is a finding.

Discussion

Access layer switches use the Content Addressable Memory (CAM) table to direct traffic to specific portsinterfaces based on the VLAN number and the destination MAC address of the frame. When a router has an Address Resolution Protocol (ARP) entry for a destination host and forwards it to the access layer switch and there is no entry corresponding to the frame's destination MAC address in the incoming VLAN, the frame will be sent to all forwarding portsinterfaces within the respective VLAN, which causes flooding. Large amounts of flooded traffic can saturate low -bandwidth links, causing network performance issues or complete connectivity outage to the connected devices. Unknown unicast flooding has been a nagging problem in networks that have asymmetric routing and default timers. To mitigate the risk of a connectivity outage, the Unknown Unicast Flood Blocking (UUFB) feature must be implemented on all access layer switches. The UUFB feature will block unknown unicast traffic floodingmust andnot onlybe permitflooded egress traffic with MAC addresses that are known to exitall onaccess the portinterfaces. For Cisco ACI, L2 Unknown Unicast decides whether the bridge domain should flood packets that are destined to an unknown MAC address (Flood) or should send it to a spine node for COOP database lookup (Hardware Proxy).

V-272033 in V1R2

Check text

Review the port security policies for compliance: 1. InNavigate theto GUIFabric menu>> bar,Access clickPolicies Fabric>> Interfaces >> AccessLeaf Policies. 2.Interfaces In>>Policy theGroups Navigation>> pane(Leaf Access port, expandPC Policiesinterface or VPC interface) >> Interface{{your_policy_name}} >> PortAdvance SecurityPolicies. 3. Select each port security policy used and verify the following: - Port Security Timeout is set to "600 seconds". - Violation Action is set to "Protect mode". - Maximum Endpoints is set to "1". Verify port security is active on all appropriate host-facing interfaces: 1. In the Navigation pane, click Fabric >> Inventory >> Topology. 2. Verify that each leaf has been configured to use a correctly configured port security policy. If port security is not configured and enabled, this is a finding.

Fix text

Create a port security policy. The port security policy can be created new or chosen from the list of available port security policies. 1. Path Into theuse GUIPort menuSecurity bar,setting: click Fabric >> Access Policies. 2. In>> theInterfaces Navigation>> paneLeaf Interfaces >>Policy Groups >> (Leaf Access port, expandPC Policiesinterface or VPC interface) >> Interface{{your_policy_name}} >> PortAdvance SecurityPolicies. 3. If Right-clickthe "PortPolicy Security"group andis clicknot "Createon Portthe SecurityAppropriate Policy".interface, navigate to the following to add it: 4.Fabric >> Access Policies >> Interfaces >> Leaf Interfaces >> Profiles >> {{your_profile}} In the Create Port Security Policy dialog box: -1. In the Port Security Timeout field, enter "600" before reenablingre-enabling MAC learning on an interface. -2. In the Maximum Endpoints field, enter "1" for the maximum number of endpoints that can be learned on an interface. -3. In the Violation Action field, select "Protect". 54. Click "Submit". Configure each host-facing interface for the leaf switches: 1. In the Navigation pane, click Fabric >> Inventory >> Topology, and navigate to the desired leaf switch. 2. Choose the appropriate port to configure the interface. 3. From the port security policy drop-down list, choose the desired port security policy to associate.

V-272037 in V1R2

Check text

Review the switch configuration to verify that storm control is enabled on all host-facing interfaces as shown in the example below.: 1. NavigateTo verify Storm Control settings, navigate to Fabric >> Access Policies >> PoliciesInterfaces >> InterfaceLeaf Interfaces >>Policy StormGroups Control>> (Leaf Access port, PC interface or VPC interface) >> {{your_policy_name}} >> Advance Policies. 2. Review each Storm Control policy. 3. Navigate to the Application Profile containing the EPGs to be protected. 4. Select each EPG, andthen go to the "Policies" tab to verify that a storm control policy that is configured for to protect broadcast, at a minimum, has been applied. If storm control is not enabled for host-facing interfaces for broadcast traffic at a, minimum, for broadcast traffic, this is a finding.

Fix text

Configure one or more storm control policies for all host-facing interfaces and external interfaces and apply the policy to an ESG. 1. NavigateEnable monitoring to Fabrictrack >>storm Accesscontrol Policies >> Policies >> Interface >> Storm Controlevents. 2. Path Click "Add" to createuse astorm newcontrol policy and define the following parameterssetting: - GiveFabric the>> policyAccess aPolicies descriptive>> name.Interfaces ->> ChooseLeaf "Broadcast"Interfaces as>> thePolicy typeGroups of>> traffic(Leaf toAccess controlport, andPC otherinterface typesor asVPC needed (e.g., Multicast, Unknown Unicastinterface). ->> Set{{your_policy_name}} the>> thresholdAdvance for the traffic typePolicies. (Refer to note below.) - If Specify "log" as the action to take when the threshold is exceeded (e.g., drop, log). - Enable monitoring to track storm control events.is Applynot on the Stormappropriate Controlinterface, Policyadd toit anby EPG: 1.navigating Navigate to theFabric Application>> ProfileAccess containing the EPGs to be protected. 2. Select the EPG and navigate to the "Policies" tab. 3.>> UnderInterfaces "Interface",>> selectLeaf theInterfaces newly>> createdProfiles "Storm>> Control" policy{{your_profile}}. 4. Click "Apply". Note: The acceptable range is 10000000-1000000000 for a gigabit Ethernet interface, and 100000000-10000000000 for a ten gigabit interface. Storm control is not supported on most FastEthernet interfaces.

V-272038 in V1R2

Check text

Verify the switch configuration enables IGMP orand MLD snooping for IPv4 and IPv6 multicast traffic. Below To isshow anthat examplethe ofIGMP or MLD policy is assigned to the stepscorrect Bridge domain, navigate to verifyTenants that>> IGMP{{Your_Tenant}} snooping>> isNetworking enabled>> forBridge eachDomains VLAN: apic1(config-tenant-template-ip-igmp-snooping)#>> show{{your_BridgeDomain}} run>> allPolicy >> General. Select the IGMP snoop Policy and MLD Snoop Policy. If the switch is not configured to implement IGMP or MLD snooping for each VLANbridge domain, this is a finding.

Fix text

Configure IGMP orand MLD snooping for IPv4 and IPv6 multicast traffic respectively globally. Example: apic1(config-tenant)#To templateshow ipthat igmpthe snoopingIGMP and/or MLD policy &ltpolicyis nameassigned to the correct Bridge domain, navigate to Tenants >> {{Your_Tenant}} >> Networking >> Bridge Domains >> {{your_BridgeDomain}} >> Policy >> General. Select the IGMP snoop Policy and MLD Snoop Policy.

V-272039 in V1R2

Check text

Verify the FHS policy is configured. Note:To Thisvalidate isthe anBD example.has TheFHS exactconfigured, configurationnavigate mayto varyTenants with>> the{{Your_Tenant}} site's>> architecture. leaf4#Networking show>> fhsBridge btdomains all The>> following{{your_BridgeDomain_Name}} settings>> mustPolicy be>> enabledAdvanced/Troubleshooting. atSearch afor minimum: -First ip-inspection-admin-statusHop enabled-both -Security source-guard-admin-status enabled-bothPolicy. - router-advertisement-guard-admin-status enabled -To router-advertisement-guard -validate managed-config-check -the managed-config-flag -First other-config-check -hop other-config-flag -Security maximum-router-preferencePolicy low -settings, minimum-hop-limitnavigate 10 -to maximum-hop-limitTenants 100 Trust-control>> tcpolicyPolicies settings: ->> arp -Protocol dhcpv4-server>> -First dhcpv6-server -Hop ipv6-routerSecurity. - router-advertisement - neighbor-discovery If an FHS policy is not configured with all required settings, this is a finding.

Fix text

Configure the FHS policy. Note:Tenants This>> is{{Your_Tenant}} an>> example.Networking The>> exactBridge configurationdomains may>> vary{{your_BridgeDomain_Name}} with>> thePolicy site's architecture. Example: apic1(config)# tenant &lttenant name> apic1(config-tenant)#> first-hop-security apic1(config-tenant-fhs)#Advanced/Troubleshooting security-policy secpol1 apic1(config-tenant-fhs-secpol)# apic1(config-tenant-fhs-secpol)#Create ip-inspection-admin-statusa enabled-both apic1(config-tenant-fhs-secpol)#First source-guard-admin-statusHop enabled-both apic1(config-tenant-fhs-secpol)#Security router-advertisement-guard-admin-status enabled apic1(config-tenant-fhs-secpol)# router-advertisement-guard apic1(config-tenant-fhs-raguard)# apic1(config-tenant-fhs-raguard)# managed-config-check apic1(config-tenant-fhs-raguard)# managed-config-flag apic1(config-tenant-fhs-raguard)# other-config-check apic1(config-tenant-fhs-raguard)# other-config-flag apic1(config-tenant-fhs-raguard)# maximum-router-preference low apic1(config-tenant-fhs-raguard)# minimum-hop-limit 10 apic1(config-tenant-fhs-raguard)# maximum-hop-limit 100 apic1(config-tenant-fhs-raguard)# exit apic1(config-tenant-fhs-secpol1)# exit apic1(config-tenant-fhs)# trust-control tcpol1 apic1(config-tenant-fhs-trustctrl)# arp apic1(config-tenant-fhs-trustctrl)# dhcpv4-server apic1(config-tenant-fhs-trustctrl)# dhcpv6-server apic1(config-tenant-fhs-trustctrl)# ipv6-router apic1(config-tenant-fhs-trustctrl)# router-advertisement apic1(config-tenant-fhs-trustctrl)# neighbor-discovery apic1(config-tenant-fhs-trustctrl)# exit apic1(config-tenant-fhs)# exit apic1(config-tenant)# bridge-domain bd1 apic1(config-tenant-bd)# first-hop-security security-policy pol1 apic1(config-tenant-bd)# exit apic1(config-tenant)# application ap1 apic1(config-tenant-app)# epg epg1 apic1(config-tenant-app-epg)# first-hop-security trust-control tcpol1Policy.

Discussion

DoS events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Each Bridge Domain is going to have the option to configure First hop Security Policies. If nothing is listed on the FHS policy, the Common tenant Default policy should be the enforced settings. FHS features enable a better IPv4 and IPv6 link security and management over the layer 2 links. In a service provider environment, these features closely control address assignment and derived operations. Setting include the following DOD required configurations: - Unknown Unicast Flood Blocking (UUFB) enabled. - DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources. - IP Source Guard enabled on all user-facing or untrusted access switch ports. - Dynamic Address Resolution Protocol (ARP) Inspection enabled on all user VLANs. Satisfies: SRG-NET-000362-L2S-000025, SRG-NET-000362-L2S-000026, SRG-NET-000362-L2S-000027

V-272045 in V1R2