What changed in Layer 2 Switch Security Requirements Guide V3R4V3R4 changes

Title

TheWhen using VLAN Trunk Protocol (VTP) or similar features, the layer 2 switch must authenticate all VLAN Trunk Protocol (VTP) messages with a hash function using the most secured cryptographic algorithm available.

Check text

Review the switch configuration to verify if VTP or (similarly named vendor features) is enabled. If VTP is enabled, verify that authentication has been configured. If VTP has been configured on the switch and is not authenticating VTP messages with a hash function using the most secured cryptographic algorithm available, this is a finding.

Fix text

Configure the switch to authenticate all VLANVTP Trunk(or Protocolsimilarly (VTPnamed vendor feature) messages with a hash function using the most secured cryptographic algorithm available.

Discussion

VLANVTP Trunkor Protocolother (VTP)similarly providesnamed vendor features, provide central management of VLAN domains, thus reducing administration in a switched network. When configuring a new VLAN on a VTP server, the VLAN is distributed through all switches in the domain. This reduces the need to configure the same VLAN everywhere. VTP pruning preserves bandwidth by preventing VLAN traffic (unknown MAC, broadcast, multicast) from being sent down trunk links when not needed,; that is, there are no access switch ports in neighboring switches belonging to such VLANs. An attack can force a digest change for the VTP domain enabling a rogue device to become the VTP server, which could allow unauthorized access to previously blocked VLANs or allow the addition of unauthorized switches into the domain. Authenticating VTP messages with a cryptographic hash function can reduce the risk of the VTP domain's being compromised.

V-206648 in V3R4

Title

The layer 2 switch must enable Unidirectional Lfink Dguretectiond (UDLD) to protect against one-way connections.

Check text

If any of the switch ports have fiber optic interconnections with neighbors, review the switch configuration to verify that UDLDfeatures issuch as Unidirectional Link Detection are enabled globally or on a per interface basis to protect against one-way connections. Doing so may also identify misconfigured copper cables. If the switch has fiber optic interconnections with neighbors and UDLD is not enabledconfigured to protect against one-way connections, this is a finding.

Fix text

Configure the switch toglobally enableor Unidirectionalper Linkinterface Detection (UDLD) to protect against one-way connections. Note: UDLD is a Cisco-proprietary protocol. However, other switch vendors, such as 3Com, Extreme, and D-Link, have similar functionality in their products, respectively: Device Link Detection Protocol (DLDP), Extreme Link Status Monitoring (ELSM), and D-Link Unidirectional Link Detection (DULD).

Discussion

Physical misconfiguration of network ports can cause network instability for protocols such as STP. In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. Although Whenmore suchcommon ain physicalfiber misconfiguration occursconnections, protocolsit suchcan asoccur STPin canmisconfigured causecopper network instabilitycables. Features UDLDsuch isas aUnidirectional Link Detection (UDLD) are layer 2 protocolprotocols that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Vendors may have different names for similar features. Ports configured with UDLDthese features enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down. Note: UDLD is a Cisco-proprietary protocol. However, other switch vendors, such as 3Com, Extreme, and D-Link, have similar functionality in their products, respectively: Device Link Detection Protocol (DLDP), Extreme Link Status Monitoring (ELSM), and D-Link Unidirectional Link Detection (DULD).

V-206664 in V3R4

Discussion

When trunk negotiation is enabled dynamically via features such as Dynamic Trunk Protocol (DTP) or similar, considerable time can be spent negotiating trunk settings (802.1q or ISL) when a node or interface is restored. While this negotiation is happening, traffic is dropped because the link is up from a layer 2 perspective. Packet loss can be eliminated by setting the interface statically to trunk mode, thereby avoiding dynamic trunk protocol negotiation and significantly reducing any outage when restoring a failed link or switch.

V-206665 in V3R4