V-283690

Discussion

A disabled port assigned to a user or management VLAN could be enabled accidentally or by an attacker. As a result, the attacker could gain access to that VLAN as a member. Satisfies: SRG-NET-000512-L2S-000007, SRG-NET-000512-L2S-000009, SRG-NET-000512-L2S-000010, SRG-NET-000512-L2S-000011, SRG-NET-000512-L2S-000012, SRG-NET-000512-L2S-000013

Check Content

Note: Switch ports configured for 802.1x are exempt from this requirement.

Review Nokia router configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose.

For any port to be part of a VPLS service, the port must be configured for that service. Just enabling a port does not give the port access to a bridge domain. VLAN configuration is also part of configuring a port for a VPLS service. 

Use the command below to verify all VLAN tags used for all VPLS services.

Pay attention to wildcard "*" usage in the VLAN tag portion of the service access point (SAP) ID configuration. When the wild card "*" is configured in the VLAN tag portion of the SAP, it allows all VLAN tags. 

- show service sap-using
Service Access Points
PortId                          SvcId      Ing.  Ing.    Egr.  Egr.   Adm  Opr
                                           QoS   Fltr    QoS   Fltr

1/1/c1/1:200                    200        1     none    1     none   Up   Up
1/1/c1/1:300                    300        1     none    1     none   Up   Up

If a port is configured with null encapsulation, it will allow all VLAN tags. Verify access ports are configured with "Port Encp" set to "dotq" or "qinq":

- show port
Ports on Slot 1

Port          Admin Link Port    Cfg  Oper LAG/ Port Port Port   C/QS/S/XFP/
Id            State      State   MTU  MTU  Bndl Mode Encp Type   MDIMDX

1/1/c1/1      Up    Yes  Up      1518 1518    - accs dotq cgige
1/1/c2        Up         Link Up                          conn   100G CWDM4 M*

If any access switch ports are not in use and not in an inactive VLAN, this is a finding.