← Back to Aviat Networks WTM L2 Security Technical Implementation Guide

V-286553

CAT II (Medium)

The Aviat WTM must have all disabled switch ports assigned to an unused VLAN.

Rule ID

SV-286553r1274091_rule

STIG

Aviat Networks WTM L2 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

Check Content

Verify the Aviat WTM has all disabled switch ports assigned to an unused VLAN with the following steps:

1. Log on to the Web UI using an admin account.
2. Using the Web UI, navigate to Switching and Routing >> Interfaces.
3. Identify all disabled switch ports.
4. Navigate to Switching and Routing >> VLAN Management >> Membership.
5. For each disabled switch port, verify it is assigned as an access port to an inactive VLAN that is not used for any other purpose.

If any disabled switch port is not assigned to an inactive VLAN, this is a finding.

Fix Text

Configure the Aviat WTM to assign all disabled switch ports to an unused VLAN with the following steps:

1. Log on to the Web UI using an admin account.
2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Definition.
3. If an inactive VLAN does not already exist, click "ADD", enter an unused VLAN ID and name, and click "Commit".
4. Navigate to Switching and Routing >> VLAN Management >> Membership.
5. For each disabled switch port, set the Mode to access and assign it to the inactive VLAN.
6. Click "Commit".