STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.

DISA Rule

SV-255949r960840_rule

Vulnerability Number

V-255949

Group Title

SRG-APP-000065-NDM-000214

Rule Version

ARST-ND-000120

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

Configure the account lockout policy using the following commands:

switch(config)#aaa authentication policy lockout failure 3
switch(config)#duration 900
switch(config)#exit

Check Contents

Verify the Arista device is configured to enforce the limit of three consecutive invalid logon attempts with the following command:

switch#show running-config | section aaa

aaa authentication policy lockout failure 3
duration 900

If the Arista device is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.

Vulnerability Number

V-255949

Documentable

False

Rule Version

ARST-ND-000120

Severity Override Guidance

Verify the Arista device is configured to enforce the limit of three consecutive invalid logon attempts with the following command:

switch#show running-config | section aaa

aaa authentication policy lockout failure 3
duration 900

If the Arista device is not configured to enforce the limit of three consecutive invalid logon attempts, this is a finding.

Check Content Reference

M

Target Key

5511