STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.

DISA Rule

SV-255948r991781_rule

Vulnerability Number

V-255948

Group Title

SRG-APP-000038-NDM-000213

Rule Version

ARST-ND-000110

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
• CCI-004192 - Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.

Weight

10

Fix Recommendation

Step 1: Configure an ACL for SSH access using the following commands:

switch(config)#ip access-list MGMT_NETWORK
switch(config-acl-MGMT_NETWORK)#10 permit ip 10.1.12.0/24 any
switch(config-acl-MGMT_NETWORK)#20 deny ip any any log
switch(config-acl-MGMT_NETWORK)#exit

Step 2: Apply the ACL to management ssh.

switch(config)#management ssh
switch(config-mgmt-ssh)#ip access-group MGMT_NETWORK in
switch(config-mgmt-ssh)#exit

Check Contents

Verify the Arista network device is configured with access control lists to control the flow of management information.

Step 1: Verify SSH has an inbound ACL applied as shown in the example below.

sh run | sec management ssh
ip access-group MGMT_NETWORK in

Step 2: Verify the ACL permits only hosts from the management network to access the device.

sh run | sec access-list MGMT_NETWORK
ip access-list MGMT_NETWORK
10 permit ip 10.1.12.0/24 any
20 deny ip any any log

If the Arista network device is not configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies, this is a finding.

Vulnerability Number

V-255948

Documentable

False

Rule Version

ARST-ND-000110

Severity Override Guidance

Verify the Arista network device is configured with access control lists to control the flow of management information.

Step 1: Verify SSH has an inbound ACL applied as shown in the example below.

sh run | sec management ssh
ip access-group MGMT_NETWORK in

Step 2: Verify the ACL permits only hosts from the management network to access the device.

sh run | sec access-list MGMT_NETWORK
ip access-list MGMT_NETWORK
10 permit ip 10.1.12.0/24 any
20 deny ip any any log

If the Arista network device is not configured to enforce approved authorizations for controlling the flow of management information within the device based on control policies, this is a finding.

Check Content Reference

M

Target Key

5511