STIGhub— A free STIG search and compliance tool·STIGs updated 23 hours ago

Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.

← Back to STIGs

Aviat Networks WTM L2 Security Technical Implementation Guide

Version

V1R1

Release Date

Sep 15, 2026

SCAP Benchmark ID

Aviat_Networks_WTM_L2_STIG

Total Checks

15

Tags

network

CAT I: 0CAT II: 12CAT III: 3

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKL Export CSV Export JSON Download STIG ZIP

Checks (15)

V-286549MEDIUMThe Aviat WTM must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.V-286550MEDIUMThe Aviat WTM must have Bridge Protocol Data Unit (BPDU) Guard enabled on all user-facing or untrusted access switch ports.V-286551MEDIUMThe Aviat WTM must have Spanning Tree Protocol (STP) Loop Guard enabled on all nondesignated STP switch ports.V-286552LOWThe Aviat WTM must have Storm Control configured on all host-facing switch ports.V-286553MEDIUMThe Aviat WTM must have all disabled switch ports assigned to an unused VLAN.V-286554MEDIUMThe Aviat WTM must not have the default VLAN assigned to any host-facing switch ports.V-286555MEDIUMThe Aviat WTM must have the default VLAN pruned from all trunk ports that do not require it.V-286556MEDIUMThe Aviat WTM must not use the default VLAN for management traffic.V-286557MEDIUMThe Aviat WTM must have all user-facing or untrusted ports configured as access switch ports.V-286558MEDIUMThe Aviat WTM must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.V-286559LOWThe Aviat WTM must not have any switch ports assigned to the native VLAN.V-286561MEDIUMThe Aviat WTM must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.V-286562MEDIUMThe Aviat WTM must use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.V-286565LOWThe Aviat WTM switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.V-286570MEDIUMThe Aviat WTM must be configured to protect against one-way connection on TenGigE1/1 interfaces.