Checklist Summary:

This guide provides technical recommendations intended to help network administrators improve the security of their networks. Using the information presented here, administrators can configure switches to control access, resist attacks, shield other network systems and protect the integrity and confidentiality of network traffic. Also, this guide can assist information security officers by describing the security issues related to critical systems (e.g., switches) which are part of their computer networks. This guide was developed in response to numerous questions and requests for assistance received by the Systems and Network Attack Center (SNAC). The topics covered in the guide were selected on the basis of customer interest and on the SNAC's background in securing networks. A major goal for this guide is to improve the security of the switches used on Department of Defense operational networks. This guide presents network security at Layer 2 (Data Link) of the Open Systems Interconnection Reference Model (OSI RM). A network hierarchy is introduced that explains the types of switches used in a computer network. Then vulnerabilities and corresponding countermeasures are described for the following topics: operating systems passwords management ports network services port security system availability Virtual Local Area Networks Spanning Tree Protocol access control lists logging and debugging and authentication, authorization and accounting. Advanced topics are identified for future work for this guide. A combined section of acronyms and glossary for terms used throughout this guide and a reference section are provided. Sample configuration files for two different models of Cisco switches are included that combine most of the countermeasures in this guide. Finally, a security checklist for Cisco switches summarizes the countermeasures.

Checklist Role:

• Ethernet LAN Switch

Known Issues:

Not provided.

Target Audience:

The intended audience for this guide is those individuals who administer these switches in their organization's networks. The guide presumes that these administrators have at least a basic knowledge of these switches. The administrators should be familiar with configuring the switches with the command line interface, including using commands in the User Exec mode and in the Privileged Exec mode. The authors also assume that the administrator provides physical security for each switch and allows only authorized personnel to access the switch.

Target Operational Environment:

• Managed

Testing Information:

The security configuration guide has been extensively tested in a lab and operational environment.

Regulatory Compliance:

Not provided.

Comments/Warnings/Miscellaneous:

Refer to Known Issues.

Disclaimer:

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. Security configuration guides are provided for the Department of Defense and other government agencies requiring security configuration guidelines. The guides contain recommended security settings. They are not intended to replace well-structured policy or sound judgment. The guides do not address site-specific configuration issues. Care must be taken when implementing the guides to address local operational and policy concerns. All security changes described in the guides are applicable only to specifically identified operating systems or architecture components and should not be applied to any other operating system or architecture components.

Product Support:

Not provided.

Point of Contact:

SNAC.Guides@nsa.gov

Sponsor:

Not provided.

Licensing:

Refer to the legal statement provided at: switch-guide-version1_01.pdf

Change History:

v0.9, 2004-03-16
v0.9a, 2004-05-07
v0.9b, 2004-05-14
v1.0, 2004-06-21
Updated status to Archive - 10/24/18

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 10/24/2018