Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

From Perimeter L3 Switch Security Technical Implementation Guide - Cisco

Part of ACLs must restrict access to server VLANs.

Associated with IA controls: ECSC-1

SV-20061r2_rule Server VLAN interfaces must be protected by restrictive ACLs using a deny-by-default security posture.

Vulnerability discussion

Protecting data sitting in a server VLAN is necessary and can be accomplished using access control lists on VLANs provisioned for servers. Without proper access control of traffic entering or leaving the server VLAN, potential threats such as a denial of service, data corruption, or theft could occur, resulting in the inability to complete mission requirements by authorized users.

Check content

Review the device configuration to validate an ACL with a deny-by-default security posture has been implemented on the server VLAN interface.

Fix text

Configure an ACL to protect the server VLAN interface. The ACL must be in a deny-by-default security posture.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.