Switch Integration & VLAN Topology
Replaces inferred VLAN boundaries with authoritative ones the assessor cannot argue with.
The problem
Without switch access, network segmentation findings are educated guesses. A printer on the same /24 as a workstation might or might not be on the same VLAN. A hardware refresh that left a host on the wrong VLAN looks identical to one that did not. The assessor asks for the switch config, the contractor cannot produce a definitive answer in the timeframe required, and the finding stands at full deduction value.
With switch access, the same questions have one-sentence answers. The VLAN table maps every port to a VLAN. The CAM table maps every MAC to a port. Cross-referencing the network scanner's discovered hosts against the CAM table yields each host's actual VLAN, printer, server, OT controller, every one of them. Trunk port configurations expose whether segmentation is enforced at the boundary or whether 1 through 4094 is allowed on every trunk.
SNMP v2c with the public community string is itself a finding, since the switch configuration is readable to anyone on the network. SNMP v3 with MD5 auth or DES privacy fails 3.13.11 on the management plane outright. The integration audits its own connection method while it gathers topology data, so the agent never becomes a finding the assessor records.
What CMMC requires
NIST SP 800-171 Rev 2 controls this agent verifies. Primary mappings drive the gap assessment; secondary mappings provide supporting evidence in the SSP.
Provides authoritative VLAN boundaries rather than inferred ones. Trunk-port findings expose where the boundary protection mechanism is defined but not actually enforced.
Read in NIST 800-171 r2↗The VLAN table and CAM table together produce the authoritative permit-list. Unnamed VLANs and unexpected hosts are exceptions never documented or reviewed.
Read in NIST 800-171 r2↗Audits the management channel to the switch,SNMP v3 with MD5 or DES uses non-FIPS algorithms on the channel that carries CUI boundary configuration.
Read in NIST 800-171 r2↗Confirms,definitively, from the switch's own data,when printers, OT devices, or guest devices share a VLAN with CUI hosts.
Read in NIST 800-171 r2↗SNMP v2c with the public community grants unauthenticated read access to switch configuration to every host on the network.
Read in NIST 800-171 r2↗How it works
Per-platform detection logic. The agent runs unprivileged where possible and falls back gracefully when raw access is unavailable.
Listens passively for LLDP and CDP frames for 60 seconds with raw socket access (CAP_NET_RAW). Walks Q-BRIDGE-MIB (1.3.6.1.2.1.17.7.1.4.3) for VLAN tables and BRIDGE-MIB (1.3.6.1.2.1.17.4.3.1 / 1.3.6.1.2.1.17.7.1.2.2) for CAM table data via SNMP v2c or v3. Falls back to SSH with vendor-specific commands: show vlan brief / show mac address-table on Cisco IOS, show vlans / show ethernet-switching table on JunOS, show vlans / show mac-address on HP-Aruba, and mca-dump on UniFi.
Uses Windows raw socket APIs (Npcap) for LLDP/CDP capture across each configured subnet. SNMP and SSH paths work the same way as Linux against the same MIB tree, with credentials stored in Windows Credential Manager through the system keychain abstraction. No plaintext credentials touch disk at any point.
macOS Keychain stores switch credentials transparently. LLDP capture requires root for raw socket access, with the same explicit runtime warning as the network scanner if elevation is unavailable. SNMP and SSH paths work fully unprivileged so most of the audit completes without elevation.
What it finds
Concrete findings written to the assessor's mental model,not abstract categories. Severity drives POA&M priority and SPRS deduction.
- CRITICALOT device MAC on CUI VLANIndustrial controller's MAC OUI matches a known OT vendor and the CAM table places it on the same VLAN as a CUI server. Network segmentation is not enforced where it must be.
- HIGHTrunk port allows VLANs 1-4094Trunk port at the CUI boundary has no VLAN restriction,segmentation is defined but not enforced. Any VLAN can traverse the trunk, including ones that should not cross the boundary.
- HIGHPrinter VLAN matches CUI host VLANSwitch CAM table confirms the printer and a CUI server are on the same VLAN. No longer a heuristic,definitive 3.13.3 finding.
- HIGHSNMP v2c public community respondingSwitch configuration is readable by any host on the network. The configuration that enforces the CUI boundary is itself unprotected.
- HIGHSNMP v3 using DES privacySwitch management channel uses non-FIPS-approved cipher. Configuration data,including VLAN assignments,transits a channel that does not protect it under 3.13.11.
- MEDIUMUnnamed VLAN exists on switchVLAN ID configured with no name set. May be a forgotten segment from a previous deployment,every VLAN should be intentional and documented.
Switch-level findings convert heuristic 3.13.1 (5-point) and 3.13.3 (3-point) findings into definitive ones, which is what the assessor will write down regardless of contractor explanation. Trunk-port misconfigurations alone hit 3.13.1 (5 points) and 3.13.2 (3 points). SNMP v3 with non-FIPS auth or privacy adds 3.13.11 (5 points) on the management plane. The combined exposure for an unsegmented OT-on-CUI environment is routinely 13+ points across three controls, and authoritative VLAN data is the only way to argue any of those findings down.
How it hooks into the platform
With switch credentials registered once in the platform's keychain, Tolerance polls VLAN and CAM tables on a cadence and merges them with network-scanner output. You choose whether the switch dump and merged topology stay on-prem or sync up. VLAN data renders into the SSP network diagram as Mermaid subgraph blocks, so the assessor sees actual VLANs rather than subnets labeled VLAN. Trunk configuration appears in the 3.13.1 boundary narrative; POA&M items reference the switch port and VLAN ID. New VLANs or hosts moving between VLANs alert on the next poll.
How we know it's working
Acceptance criteria from the engineering spec,what the agent must do to ship.
- Pulls VLAN and CAM data via SNMP v2c, SNMP v3, or vendor SSH
- Parses Cisco IOS, JunOS, HP-Aruba, and UniFi command output natively
- Captures LLDP and CDP frames passively across configured subnets
- Returns definitive printer-on-CUI-VLAN findings when switch data is present
- Always flags trunk ports with all VLANs (1-4094) permitted as findings
- Stores credentials only in the system keychain, never on disk
- Degrades gracefully within 30 seconds of any SNMP or SSH timeout
Run this agent against your environment.
Book a 30-minute scoping call. We'll deploy the agent on your systems and walk through the findings together.