Hi,
I extend the NCM-Template (DISA STIG - Access Switchport Baseline.ncm-template) from CourtesyIT.with following commands:
switchport nonegotiate
switchport block multicast
!(blocks inbound unknown multicast)
switchport port-security aging time 10
switchport port-security aging type inactivity
!(through my experience These coif you Need more security delete these lines )
storm-control broadcast level pps 50
storm-control multicast level bps 100k
storm-control action shutdown
storm-control action trap
!(that a cisco default values)
spannig-tree bpduguard enable
!(shuts the ports if stp bpdu's are received from the client)
I hope ou like it.
Kind regards,
Flo
