The Dell OS10 Switch must uniquely identify all network-connected endpoint devices before establishing any connection.

An XCCDF Rule

Description

Controlling LAN access via 802.1x authentication can assist in preventing a malicious user from connecting an unauthorized PC to a switch port to inject or receive data from the network without detection. Satisfies: SRG-NET-000148-L2S-000015, SRG-NET-000343-L2S-000016

ID: SV-269953r1052245_rule
Version: OS10-L2S-000020
Severity: High
References: CCI-000778 CCI-001958
Updated: about 2 months ago

Remediation Templates

Configure 802.1 x authentications on all host-facing access switch ports. 

Configure RADIUS for 802.1x authentication:

OS10(config)# radius-server host 10.10.1.200 key my-shared-secret
OS10(config)# radius-server retransmit 10OS10(config)# radius-server timeout 10

Enable 802.1X globally in CONFIGURATION mode:

OS10(config)# dot1x system-auth-control

Enable 802.1x on the host-facing access interfaces:

OS10(config)# interface range ethernet 1/1/2-1/1/48
OS10(conf-rangeeth1/1/2-1/1/48)# dot1x port-control auto
OS10(conf-rangeeth1/1/2-1/1/48)# dot1x re-authentication

The Dell OS10 Switch must uniquely identify all network-connected endpoint devices before establishing any connection.

Description

Remediation Templates

A Manual Procedure