Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Cisco ACI layer 2 switch must employ a first-hop-security (FHS) policy to protect against denial-of-service (DoS) attacks.
Description
Discussion Text
DoS events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth.
Each Bridge Domain is going to have the option to configure First hop Security Policies. If nothing is listed on the FHS policy, the Common tenant Default policy should be the enforced settings.
FHS features enable a better IPv4 and IPv6 link security and management over the layer 2 links. In a service provider environment, these features closely control address assignment and derived operations. Setting include the following DOD required configurations:
- Unknown Unicast Flood Blocking (UUFB) enabled.
- DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources.
- IP Source Guard enabled on all user-facing or untrusted access switch ports.
- Dynamic Address Resolution Protocol (ARP) Inspection enabled on all user VLANs.
Satisfies: SRG-NET-000362-L2S-000025, SRG-NET-000362-L2S-000026, SRG-NET-000362-L2S-000027
Each Bridge Domain is going to have the option to configure First hop Security Policies. If nothing is listed on the FHS policy, the Common tenant Default policy should be the enforced settings.
FHS features enable a better IPv4 and IPv6 link security and management over the layer 2 links. In a service provider environment, these features closely control address assignment and derived operations. Setting include the following DOD required configurations:
- Unknown Unicast Flood Blocking (UUFB) enabled.
- DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources.
- IP Source Guard enabled on all user-facing or untrusted access switch ports.
- Dynamic Address Resolution Protocol (ARP) Inspection enabled on all user VLANs.
Satisfies: SRG-NET-000362-L2S-000025, SRG-NET-000362-L2S-000026, SRG-NET-000362-L2S-000027
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.