V-283692

Discussion

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

Check Content

Verify the layer 2 switch is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Logical layer 2 switch separation is configured using separate virtual private local area network services (VPLS). Verify VPLS services created and access ports configured for each VPLS service using the commands below.

To view all the VPLS services created, use the following command:

- show service service-using vpls
Services [vpls]
===============================================================================
ServiceId    Type      Adm  Opr  CustomerId Service Name
-------------------------------------------------------------------------------
200          VPLS      Up   Up   1          200
300          VPLS      Up   Up   1          300

Use the command below to view all the access points that are part of each VPLS service:

- show service id 200 base | match sap
sap:1/1/c1/1:200                         q-tag        1518    1518    Up   Up

If the layer 2 switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.