What changed in HP FlexFabric Switch L2S STIG V1R4V1R4 changes

HP FlexFabric Switch L2S STIG V1R4 (2026-09-30) replaced V1R3 (2020-07-24): 22 checks added, 22 removed. It has 22 checks, against 22 in V1R3.

V1R4 checklistV1R3 checklist Compare V1R3 and V1R4 in STIG Compare

  • 22 added
  • 22 removed
  • 0 updated

Added in V1R4 (22)

  • V-214639CAT IIThe HP FlexFabric Switch must be configured to disable non-essential capabilities.
  • V-214640CAT IHP FlexFabric Switch must authenticate all network-connected endpoint devices before establishing any connection.
  • V-214641CAT IIThe HP FlexFabric Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • V-214642CAT IIThe HP FlexFabric Switch must provide the capability for authorized users to select a user session to capture.
  • V-214643CAT IIThe HP FlexFabric Switch must provide the capability for authorized users to remotely view, in real time, all content related to an established user session from a component separate from the HP FlexFabric Switch.
  • V-214644CAT IIThe HP FlexFabric Switch must have Root Guard enabled on all ports where the root bridge should not appear.
  • V-214645CAT IIThe HP FlexFabric Switch must have BPDU Guard enabled on all user-facing access ports.
  • V-214646CAT IIThe HP FlexFabric Switch must have STP Loop Protection enabled all non-designated STP switch ports.
  • V-214647CAT IIThe HP FlexFabric Switch must have unknown storm-constrain enabled.
  • V-214648CAT IIThe HP FlexFabric Switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources as well as rate-limit DHCP traffic.
  • V-214649CAT IIThe HP FlexFabric Switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
  • V-214650CAT IIThe HP FlexFabric Switch must have Dynamic ARP Inspection (DAI) enabled on all user VLANs.
  • V-214651CAT IIThe HP FlexFabric Switch must implement Rapid STP where VLANs span multiple switches with redundant links.
  • V-214652CAT IIThe HP FlexFabric Switch must enable Device Link Detection Protocol (DLDP) to protect against one-way connections.
  • V-214653CAT IIThe HP FlexFabric Switch must have all trunk links enabled statically.
  • V-214654CAT IIThe HP FlexFabric Switch must have all disabled switch ports assigned an unused VLAN.
  • V-214655CAT IIThe HP FlexFabric Switch must not have the default VLAN assigned to any host-facing switch ports.
  • V-214656CAT IIThe HP FlexFabric Switch must have the default VLAN pruned from all trunk ports that do not require it.
  • V-214657CAT IIThe HP FlexFabric Switch must not use the default VLAN for management traffic.
  • V-214658CAT IIThe HP FlexFabric Switch must have all user-facing or untrusted ports configured as access switch ports.
  • V-214659CAT IIThe HP FlexFabric Switch must have the native VLAN assigned to a VLAN ID other than the default VLAN ID for all 802.1q trunk links.
  • V-214660CAT IIThe HP FlexFabric Switch must not have any access switch ports assigned to the native VLAN.

Removed since V1R3 (22)

  • V-65961CAT IIThe HP FlexFabric Switch must be configured to disable non-essential capabilities.
  • V-66051CAT IHP FlexFabric Switch must authenticate all network-connected endpoint devices before establishing any connection.
  • V-66057CAT IIThe HP FlexFabric Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • V-66059CAT IIThe HP FlexFabric Switch must provide the capability for authorized users to select a user session to capture.
  • V-66061CAT IIThe HP FlexFabric Switch must provide the capability for authorized users to remotely view, in real time, all content related to an established user session from a component separate from the HP FlexFabric Switch.
  • V-66063CAT IIThe HP FlexFabric Switch must have Root Guard enabled on all ports where the root bridge should not appear.
  • V-66065CAT IIThe HP FlexFabric Switch must have BPDU Guard enabled on all user-facing access ports.
  • V-66067CAT IIThe HP FlexFabric Switch must have STP Loop Protection enabled all non-designated STP switch ports.
  • V-66069CAT IIThe HP FlexFabric Switch must have unknown storm-constrain enabled.
  • V-66071CAT IIThe HP FlexFabric Switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources as well as rate-limit DHCP traffic.
  • V-66073CAT IIThe HP FlexFabric Switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
  • V-66075CAT IIThe HP FlexFabric Switch must have Dynamic ARP Inspection (DAI) enabled on all user VLANs.
  • V-66077CAT IIThe HP FlexFabric Switch must implement Rapid STP where VLANs span multiple switches with redundant links.
  • V-66079CAT IIThe HP FlexFabric Switch must enable Device Link Detection Protocol (DLDP) to protect against one-way connections.
  • V-66081CAT IIThe HP FlexFabric Switch must have all trunk links enabled statically.
  • V-66085CAT IIThe HP FlexFabric Switch must have all disabled switch ports assigned an unused VLAN.
  • V-66087CAT IIThe HP FlexFabric Switch must not have the default VLAN assigned to any host-facing switch ports.
  • V-66089CAT IIThe HP FlexFabric Switch must have the default VLAN pruned from all trunk ports that do not require it.
  • V-66091CAT IIThe HP FlexFabric Switch must not use the default VLAN for management traffic.
  • V-66093CAT IIThe HP FlexFabric Switch must have all user-facing or untrusted ports configured as access switch ports.
  • V-66095CAT IIThe HP FlexFabric Switch must have the native VLAN assigned to a VLAN ID other than the default VLAN ID for all 802.1q trunk links.
  • V-66097CAT IIThe HP FlexFabric Switch must not have any access switch ports assigned to the native VLAN.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R4 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.