None Computing title Aviat Networks WTM L2 Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-286549 Rule_ID SV-286549r1274263_rule Severity medium Rule_Title The Aviat WTM must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks. Vuln_Discuss DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed DoS (DDoS) attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch by using readily available tools such as Low Orbit Ion Cannon or by using botnets. Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages). Satisfies: SRG-NET-000193-L2S-000020, SRG-NET-000057-L2S-000005, SRG-NET-000520-L2S-000105 Check_Content Verify the Aviat WTM has the default DSCP decode policy configured with required priority mappings and applied to all required interfaces with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Encoding/Decoding >> DSCP. 3. Locate the "default" row and verify "Exists" is selected for each required DSCP value with the correct priority and color mappings in accordance with DoW traffic prioritization requirements. 4. Navigate to Switching and Routing >> Quality of Service >> Interfaces. 5. Verify each required interface has the "default" DSCP decode policy assigned in the DSCP Decode Policy column. If the default DSCP decode policy does not have required priority mappings configured in accordance with site security and configuration plan, or if it is not assigned to all required interfaces, this is a finding. Fix_Text Configure the Aviat WTM default DSCP decode policy with required priority mappings and apply it to all required interfaces with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Encoding/Decoding >> DSCP. 3. Select the "default" row to edit it. 4. For each DSCP value (0-63), select "Exists" and set the priority and color in accordance with DoW traffic prioritization requirements. Scroll down to ensure all values are configured in accordance with site security and configuration plan. 5. Click "Commit". 6. Navigate to Switching and Routing >> Quality of Service >> Interfaces. 7. For each required interface, select "default" from the DSCP Decode Policy drop-down and select "default" from the DSCP Encode Policy drop-down. 8. Click "Commit". Not_Reviewed Vuln_Num V-286550 Rule_ID SV-286550r1274088_rule Severity medium Rule_Title The Aviat WTM must have Bridge Protocol Data Unit (BPDU) Guard enabled on all user-facing or untrusted access switch ports. Vuln_Discuss If a rogue switch is introduced into the topology and transmits a BPDU with a lower bridge priority than the existing root bridge, it will become the new root bridge and cause a topology change, rendering the network in a suboptimal state. The Spanning Tree Protocol (STP) PortFast BPDU guard enhancement allows network designers to enforce the STP domain borders and keep the active topology predictable. The devices behind the ports that have STP PortFast enabled are not able to influence the STP topology. At the reception of BPDUs, the BPDU guard operation disables the port that has PortFast configured. The BPDU guard transitions the port into errdisable state and sends a log message. Check_Content Verify the Aviat WTM has BPDU Guard enabled on all user-facing or untrusted access switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. Review the Interfaces table and verify "Port Fast" is selected for each user-facing or untrusted access port. 4. Verify BPDU Guard is selected for each user-facing or untrusted access port. If the Port Fast or BPDU Guard checkbox is not selected for all user-facing or untrusted access switch ports, this is a finding. Fix_Text Configure the Aviat WTM to enable BPDU Guard on all user-facing or untrusted access switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. In the Interfaces table, select "Port Fast" for each user-facing or untrusted access port. 4. Select "BPDU Guard" for each user-facing or untrusted access port. 5. Click "Commit". Not_Reviewed Vuln_Num V-286551 Rule_ID SV-286551r1274266_rule Severity medium Rule_Title The Aviat WTM must have Spanning Tree Protocol (STP) Loop Guard enabled on all nondesignated STP switch ports. Vuln_Discuss The STP loop guard feature provides additional protection against STP loops. An STP loop is created when an STP blocking port in a redundant topology erroneously transitions to the forwarding state. In its operation, STP relies on continuous reception and transmission of BPDUs based on the port role. The designated port transmits BPDUs, and the nondesignated port receives BPDUs. When one of the ports in a physically redundant topology no longer receives BPDUs, the STP conceives that the topology is loop free. Eventually, the blocking port from the alternate or backup port becomes a designated port and moves to a forwarding state. This situation creates a loop. The loop guard feature makes additional checks. If BPDUs are not received on a nondesignated port and loop guard is enabled, that port is moved into the STP loop-inconsistent blocking state. Satisfies: SRG-NET-000362-L2S-000023, SRG-NET-000512-L2S-000003 Check_Content Verify the Aviat WTM has Rapid Spanning Tree Protocol (RSTP) enabled. 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. Verify the "Mode" field is set to "RSTP". If the "Mode" field is not set to "RSTP", this is a finding. Fix_Text Configure the Aviat WTM to enable RSTP. 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. In the "Mode" field, select "RSTP". 4. Click "Commit". Not_Reviewed Vuln_Num V-286552 Rule_ID SV-286552r1274090_rule Severity low Rule_Title The Aviat WTM must have Storm Control configured on all host-facing switch ports. Vuln_Discuss A traffic storm occurs when packets flood a LAN, creating excessive traffic and degrading network performance. Traffic storm control prevents network disruption by suppressing ingress traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors ingress traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval. Satisfies: SRG-NET-000362-L2S-000024, SRG-NET-000512-L2S-000001 Check_Content Verify the Aviat WTM has Storm Control configured on all host-facing switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Storm Control. 3. Verify that Storm Control is configured with peak-rate limits for multicast, broadcast, and unknown unicast traffic on each host-facing switch port. If Storm Control is not configured on all host-facing switch ports, this is a finding. Fix_Text Configure the Aviat WTM to enable Storm Control on all host-facing switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Storm Control. 3. For each host-facing switch port, configure peak-rate limits for multicast, broadcast, and unknown unicast traffic in accordance with site requirements. 4. Click "Commit". Not_Reviewed Vuln_Num V-286553 Rule_ID SV-286553r1274091_rule Severity medium Rule_Title The Aviat WTM must have all disabled switch ports assigned to an unused VLAN. Vuln_Discuss It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member. Check_Content Verify the Aviat WTM has all disabled switch ports assigned to an unused VLAN with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Interfaces. 3. Identify all disabled switch ports. 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. For each disabled switch port, verify it is assigned as an access port to an inactive VLAN that is not used for any other purpose. If any disabled switch port is not assigned to an inactive VLAN, this is a finding. Fix_Text Configure the Aviat WTM to assign all disabled switch ports to an unused VLAN with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Definition. 3. If an inactive VLAN does not already exist, click "ADD", enter an unused VLAN ID and name, and click "Commit". 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. For each disabled switch port, set the Mode to access and assign it to the inactive VLAN. 6. Click "Commit". Not_Reviewed Vuln_Num V-286554 Rule_ID SV-286554r1274092_rule Severity medium Rule_Title The Aviat WTM must not have the default VLAN assigned to any host-facing switch ports. Vuln_Discuss In a VLAN-based network, switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly. Check_Content Verify the Aviat WTM does not have the default VLAN (VLAN 1) assigned to any host-facing switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. Based on the site's documented configuration plan, for each host-facing switch port, verify the access VLAN is not set to VLAN 1. If any host-facing switch port is assigned to VLAN 1, this is a finding. Fix_Text Configure the Aviat WTM to remove VLAN 1 from all host-facing switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each host-facing switch port assigned to VLAN 1, change the access VLAN to a nondefault VLAN. 4. Click "Commit". Not_Reviewed Vuln_Num V-286555 Rule_ID SV-286555r1274093_rule Severity medium Rule_Title The Aviat WTM must have the default VLAN pruned from all trunk ports that do not require it. Vuln_Discuss The default VLAN (i.e., VLAN 1) is a special VLAN used for control plane traffic such as Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP). VLAN 1 is enabled on all trunks and ports by default. With larger campus networks, care needs to be taken about the diameter of the STP domain for the default VLAN. Instability in one part of the network could affect the default VLAN, thereby influencing control-plane stability and therefore, STP stability for all other VLANs. Check_Content Verify the Aviat WTM has VLAN 1 pruned from all trunk ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each trunk port, verify VLAN 1 is not included in the tagged VLAN list. If VLAN 1 is permitted on any trunk port, this is a finding. Fix_Text Configure the Aviat WTM to remove VLAN 1 from all trunk ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each trunk port, remove VLAN 1 from the tagged VLAN list. 4. Click "Commit". Not_Reviewed Vuln_Num V-286556 Rule_ID SV-286556r1274094_rule Severity medium Rule_Title The Aviat WTM must not use the default VLAN for management traffic. Vuln_Discuss Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)—all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly. Check_Content Verify the Aviat WTM does not use the default VLAN (VLAN 1) for management traffic with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each management port, verify the access VLAN is not set to VLAN 1. If any management port is assigned to VLAN 1, this is a finding. Fix_Text Configure the Aviat WTM to remove VLAN 1 from all management ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each management port assigned to VLAN 1, change the access VLAN to the management VLAN. 4. Click "Commit". Not_Reviewed Vuln_Num V-286557 Rule_ID SV-286557r1274095_rule Severity medium Rule_Title The Aviat WTM must have all user-facing or untrusted ports configured as access switch ports. Vuln_Discuss Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attacker's VLAN ID (probably the well-known and omnipresent default VLAN) is stripped off by the switch, and the inner tag that will have the victim's VLAN ID is used by the switch as the next hop and sent out the trunk port. Check_Content Verify the Aviat WTM has all user-facing or untrusted ports configured as access switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each user-facing or untrusted port, verify the Mode is set to access. If any user-facing or untrusted port is configured as a trunk, this is a finding. Fix_Text Configure the Aviat WTM to set all user-facing or untrusted ports as access switch ports with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each user-facing or untrusted port configured as a trunk, change the Mode to access. 4. Click "Commit". Not_Reviewed Vuln_Num V-286558 Rule_ID SV-286558r1274096_rule Severity medium Rule_Title The Aviat WTM must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links. Vuln_Discuss VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch that the victim is connected to. If the attacker knows the victim's MAC address, it can forge a frame with two 802.1q tags and a layer 2 header with the destination address of the victim. Since the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to the victim's switch will simply remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame on to the trunk link unaware of the inner tag with a VLAN ID of which the victim's switch port is a member. Check_Content Verify the Aviat WTM has the native VLAN set to an ID other than VLAN 1 on all 802.1q trunk links with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each trunk port, verify the native (untagged) VLAN is not set to VLAN 1. If the native VLAN on any trunk port is set to VLAN 1, this is a finding. Fix_Text Configure the Aviat WTM to set the native VLAN to an ID other than VLAN 1 on all 802.1q trunk links with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Definition. 3. If a dedicated native VLAN does not already exist, click "ADD", enter a nondefault VLAN ID and name, and click "Commit". 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. For each trunk port with a native VLAN of VLAN 1, change the native (untagged) VLAN to the newly created nondefault VLAN ID. 6. Click "Commit". Not_Reviewed Vuln_Num V-286559 Rule_ID SV-286559r1274097_rule Severity low Rule_Title The Aviat WTM must not have any switch ports assigned to the native VLAN. Vuln_Discuss Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached to a different switch belonging to the same trunk group, thereby requiring the trunk link and frame tagging, the malicious user can begin the attack by sending frames with two sets of tags. The outer tag that will have the attacker's VLAN ID (probably the well-known and omnipresent default VLAN) is stripped off by the switch, and the inner tag that will have the victim's VLAN ID is used by the switch as the next hop and sent out the trunk port. Check_Content Verify the Aviat WTM does not have any switch ports assigned to the native VLAN with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each switch port, verify the VLAN assignment is not set to the native VLAN ID. If any switch port is assigned to the native VLAN, this is a finding. Fix_Text Configure the Aviat WTM to reassign all switch ports away from the native VLAN with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Membership. 3. For each switch port assigned to the native VLAN, change the VLAN assignment to a nonnative VLAN. 4. Click "Commit". Not_Reviewed Vuln_Num V-286561 Rule_ID SV-286561r1274099_rule Severity medium Rule_Title The Aviat WTM must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. Vuln_Discuss Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. This requirement also applies to Zero Trust initiatives. Check_Content Verify the Aviat WTM implements separate management and data plane interfaces with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to System Configuration >> Management IP. 3. Verify that one GigabitEthernet interface (GigabitEthernet1/1 or GigabitEthernet1/2) is configured as the management interface. 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. Verify the remaining GigabitEthernet interface and all TenGigE interfaces (TenGigE1/1 and TenGigE1/2) are configured as data plane interfaces and are not assigned to the management VLAN. If a dedicated management interface is not configured separately from data plane interfaces, this is a finding. Fix_Text Configure the Aviat WTM to implement separate management and data plane interfaces with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Define and create a dedicated management VLAN if one does not already exist. 3. Navigate to System Configuration >> Management IP. 4. Click "ADD", select one GigabitEthernet interface (GigabitEthernet1/1 or GigabitEthernet1/2), assign it to the management VLAN, and click "Commit". 5. Navigate to Switching and Routing >> VLAN Management >> Membership. 6. Verify the remaining GigabitEthernet interface and all TenGigE interfaces (TenGigE1/1 and TenGigE1/2) are assigned only to data plane VLANs. 7. Click "Commit". Not_Reviewed Vuln_Num V-286562 Rule_ID SV-286562r1274100_rule Severity medium Rule_Title The Aviat WTM must use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions. Vuln_Discuss A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. Security attributes may be used to manage information flow control. Information flow enforcement mechanisms compare security attributes associated with information (data content and data structure) and source/destination objects, and respond appropriately (e.g., block, quarantine, alert administrator) when the mechanisms encounter information flows not allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. Security attributes can also include, for example, source and destination addresses employed in traffic filter firewalls. Flow enforcement using security attributes can be used, for example, to control the release of certain types of information. This requirement also applies to Zero Trust initiatives. Check_Content Verify the Aviat WTM is configured with a Management ACL to enforce information flow control with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Admin >> Management ACL. 3. Verify ACL rules are configured. 4. Verify the ACL is enabled. If no ACL rules are configured, or if the ACL is not enabled, this is a finding. Fix_Text Configure the Aviat WTM with a Management ACL to enforce information flow control with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Admin >> Management ACL. 3. Click "Add". 4. Enter a name for the ACL. 5. Under "Type", select "both". 6. Click "New TCP", set Match Port to "22", and set Action to "accept". 7. Click "New TCP", set Match Port to "443", and set Action to "accept". 8. Click "New UDP", set Match Port to "161", and set Action to "accept". 9. Click "New TCP", set Match Port to "51966", and set Action to "drop". 10. Click "New TCP", set Match Port to "51967", and set Action to "drop". 11. Click "New TCP", set Match Port to "830", and set Action to "drop". 12. Select "Enabled". 13. Click "Commit". Not_Reviewed Vuln_Num V-286565 Rule_ID SV-286565r1274161_rule Severity low Rule_Title The Aviat WTM switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts. Vuln_Discuss Spanning Tree Protocol (STP) does not provide any means for the network administrator to securely enforce the topology of the switched network. Any switch can be the root bridge in a network. However, a more optimal forwarding topology places the root bridge at a specific predetermined location. With the standard STP, any bridge in the network with a lower bridge ID takes the role of the root bridge. The administrator cannot enforce the position of the root bridge but can set the root bridge priority to 0 in an effort to secure the root bridge position. The root guard feature provides a way to enforce the root bridge placement in the network. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP state and no traffic can be forwarded across this port while it is in this state. To enforce the position of the root bridge it is imperative that root guard is enabled on all ports where the root bridge should never appear. Check_Content Verify the Aviat WTM has Root Guard enabled on all switch ports connecting to access layer switches and hosts with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. Review the Interfaces table and verify "Guard Root" is selected for each port connecting to an access layer switch or host. If Guard Root is not selected for all ports connecting to access layer switches and hosts, this is a finding. Fix_Text Configure the Aviat WTM to enable Root Guard on all switch ports connecting to access layer switches and hosts with the following steps: 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Spanning Tree. 3. In the Interfaces table, select "Guard Root" for each port connecting to an access layer switch or host. 4. Click "Commit". Not_Reviewed Vuln_Num V-286570 Rule_ID SV-286570r1274267_rule Severity medium Rule_Title The Aviat WTM must be configured to protect against one-way connection on TenGigE1/1 interfaces. Vuln_Discuss Physical misconfiguration of network ports can cause network instability for protocols such as STP. In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. Although more common in fiber connections, it can occur in misconfigured copper cables. WTM implementations in DoW must have Link Aggregation Control Protocol (LACP) enabled and configured on uplink switch connections to enable layer 2 link aggregation with LACP in fast rate mode. LACP continuously exchanges PDUs between link partners and will detect a unidirectional link failure when the partner stops receiving LACP PDUs, removing the failed member from the Link Aggregation Group (LAG). Note: This product does not provide UDLD (Cisco proprietary) or 802.ag protocols. It is recommended that the WTM is connected to an upstream switch that has one of these protections enabled on the connecting port. The upstream switch will detect and disable the unidirectional link, preventing a one-way forwarding condition. Check_Content If TenGigE1/1 interfaces are not installed or used, this is Not Applicable. Verify the Aviat WTM has LACP enabled and configured on TenGigE1/1 for the uplink switch connection to provide unidirectional link failure detection. 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> L2 Link Aggregation. 3. Verify the "Enabled" checkbox under "LACP Global" is selected. 4. Verify an LACP bundle exists under "LACP Bundles" with the following settings: - "Load Balance Hash" is set to an appropriate hashing algorithm. - TenGigE1/1 is listed as a member interface with "Mode" set to "Active" and "Timeout" set to "Short". If LACP is not globally enabled, or if TenGigE1/1 is not configured as a member of a LACP bundle with mode set to active and timeout set to short, this is a finding. Fix_Text Configure the Aviat WTM to enable LACP and assign TenGigE1/1 to a bundle for the uplink switch connection. 1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> L2 Link Aggregation. 3. Select the "Enabled" checkbox under "LACP Global". 4. Under "LACP Bundles", click "ADD" to create a new bundle. 5. Set "Min Active Links" to "1". 6. Set "Load Balance Hash" to the appropriate hashing algorithm in accordance with site requirements. 7. For the TenGigE1/1 interface row, set "Mode" to "Active" and "Timeout" to "Short". 8. Click "Commit". 9. On the uplink switch, configure the port connecting to TenGigE1/1 with LACP in active mode and short timeout in accordance with the uplink switch vendor documentation. Not_Reviewed