HP FlexFabric Switch L2S Security Technical Implementation Guide

The HP FlexFabric Switch L2S Security Technical Implementation Guide (V1 R4) has 22 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

22STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Sep 30 2026

The HP FlexFabric Switch must have all disabled switch ports assigned an unused VLAN.

HP FlexFabric Switch L2S Security Technical Implementation Guide

Assessment Title

Rule Text

The HP FlexFabric Switch must have all disabled switch ports assigned an unused VLAN.

Description

Discussion Text

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-214654

Rule

SV-214654r385561_rule

Severity

medium

Rule Version

HFFS-L2-000024

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the HP FlexFabric Switch configurations and examine all access switch ports.  Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose and is not allowed on any trunk links.

If there are any access switch ports not in use and not in an inactive VLAN, this is a finding.

<HP>display vlan X
 VLAN ID: X
 VLAN type: Static
 Route interface: Configured:
 Description: VLAN 000X
 Name: VLAN 000X
 Tagged ports:   None
 Untagged ports:
    GigabitEthernet1/0/1          GigabitEthernet1/0/2
    GigabitEthernet1/0/3          GigabitEthernet1/0/4

Implementation Procedure

Fix Text

Assign all switch ports not in use to an inactive VLAN.

[HP-vlanX]port GigabitEthernet 1/0/1 to GigabitEthernet 1/0/48

STIG check 16 of 22 in the HP FlexFabric Switch L2S STIG checklist

← Previous · V-214653The HP FlexFabric Switch must have all trunk links enabled statically.Next · V-214655 →The HP FlexFabric Switch must not have the default VLAN assigned to any host-facing switch ports.