WTM must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Communications paths can be logically separated using encryption.

1. Log in to the WTM Web UI. 2. Navigate to Switching and Routing >> VLAN Management >> Membership. 3. Verify that both GigabitEthernet1/1 and 1/2 are on mode access. 4. Verify GigabitEthernet1/1 and 1/2 are using different VLAN IDs.

If GigabitEthernet1/1 and 1/2 are using the same VLAN IDs, this is a finding.

1. Log in to the WTM Web UI. 2. Navigate to Switching and Routing >> VLAN Management >> Membership. 3. If GigabitEthernet1/1 is the out of band management interface, then select mode access. 4. On GigabitEthernet1/1 under settings, select the VLAN for the management network. 5. On GigabitEthernet1/2, if it is a trunk link (meaning it is carrying 802.1q tagged VLAN traffic), select trunk for the mode. 6. Enter all the VLANs in the allowed VLANs field. Ensure that the management VLAN is not in this list. 7. On GigabitEthernet1/2, if it is an access link (meaning it is carrying traffic that is not tagging the 802.1q field), select access for the mode. 8. Select the VLAN ID being used for data plane traffic. The management VLAN must not be selected. 9. Click "Commit".