The Aviat WTM must have all disabled switch ports assigned to an unused VLAN.

It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member.

Verify the Aviat WTM has all disabled switch ports assigned to an unused VLAN with the following steps:

1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Interfaces. 3. Identify all disabled switch ports. 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. For each disabled switch port, verify it is assigned as an access port to an inactive VLAN that is not used for any other purpose.

If any disabled switch port is not assigned to an inactive VLAN, this is a finding.

Configure the Aviat WTM to assign all disabled switch ports to an unused VLAN with the following steps:

1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> VLAN Management >> Definition. 3. If an inactive VLAN does not already exist, click "ADD", enter an unused VLAN ID and name, and click "Commit". 4. Navigate to Switching and Routing >> VLAN Management >> Membership. 5. For each disabled switch port, set the Mode to access and assign it to the inactive VLAN. 6. Click "Commit".