What changed in Cisco IOS XE Switch L2S STIG V3R2V3R2 changes

Cisco IOS XE Switch L2S STIG V3R2 (2025-07-02) replaced V3R1 (2024-07-24): 1 check updated. It has 22 checks, against 22 in V3R1.

V3R2 checklistV3R1 checklist Compare V3R1 and V3R2 in STIG Compare

  • 0 added
  • 0 removed
  • 1 updated

Updated fields: Check text 1

Updated in V3R2 (1)

V-220651CAT IIThe Cisco switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.Check text

Check text

Step 1: Verify that the class-maps are configured to match on DSCP values as shown in the configuration example below: class-map match-all C2_VOICE match ip dscp af4747 class-map match-all VOICE match ip dscp ef class-map match-all VIDEO match ip dscp af41 class-map match-all PREFERRED_DATA match ip dscp af33 Step 2: Verify that the policy map reserves the bandwidth for each traffic type as shown in the following example: policy-map QOS_POLICY_SWITCHPORT class C2_VOICE priority level 1 10 class VOICE priority level 2 15 class VIDEO bandwidth percent 25 class PREFERRED_DATA bandwidth percent 25 class class-default bandwidth percent 25 verone interface GigabitEthernet1/1 switchport trunk allowed vlan 100,110,200 switchport mode trunk service-policy output QOS_POLICY_SWITCHPORT ! interface GigabitEthernet1/2 switchport access vlan 100 switchport mode access switchport voice vlan 200 trust device cisco-phone service-policy output QOS_POLICY_SWITCHPORT ! interface GigabitEthernet1/2 switchport access vlan 110 switchport mode access switchport voice vlan 200 trust device cisco-phone service-policy output QOS_POLICY_SWITCHPORT If quality of service (QoS) has not been enabled, this is a finding.

V-220651 in V3R2

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.