V-283903

Discussion

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For subinterfaces, delete subinterfaces that are on inactive interfaces and delete subinterfaces that are themselves inactive. If the subinterface is no longer necessary for authorized communications, it must be deleted.

Check Content

Review the router configuration.

Verify the logical port is disabled using the command below:
 
 show port 1/1/c2/1 | match "Admin State"

Admin State        : down                       Oper Duplex      : full

Verify the logical interface is disabled using the command below:

- show router interface "TO-PE2"

Interface Table (Router: Base)

Interface-Name                   Adm       Opr(v4/v6)  Mode    Port/SapId
   IP-Address                                                  PfxState
-------------------------------------------------------------------------------
TO-PE2                           Down      Down/Down   Network 1/1/c1/1
   172.22.21.2/30                                              n/a
   2001:acad:1234:21::2/64                                     INACCESSIBLE
   fe80::67:47f1:52a9:fb0c/64                                  INACCESSIBLE
-------------------------------------------------------------------------------
Interfaces : 1

If an interface is not being used but is configured or enabled, this is a finding.