STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

DISA Rule

SV-255952r1043177_rule

Vulnerability Number

V-255952

Group Title

SRG-APP-000142-NDM-000245

Rule Version

ARST-ND-000340

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Configure the Arista network device to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

Step 1: Disable telnet with the following command:

switch#config
switch(config)#management telnet
switch(config-mgmt-telnet)#shutdown
switch(config-mgmt-telnet)#exit
switch(config)#exit

Step 2: Disable https with the following command:

switch#config
switch(config)#management api http-commands
switch(config-mgmt-api-http-commands)#shutdown
switch(config-mgmt-api-http-commands)#exit
switch(config)#exit

Check Contents

Verify the Arista network device has telnet and https disabled.

Step 1: Determine if telnet is disabled with the following command:

switch#show management telnet

Telnet status for Default VRF is disabled
Telnet session limit is 20
Telnet session limit per host is 20

If telnet is enabled, this is a finding.

Step 2: Determine if https is disabled with the following command:

switch#show management http-server

SSL Profile: none
FIPS Mode: No
QoS DSCP: 0
LogLevel: none
CSP Frame Ancestor: None
TLS Protocols: 1.0 1.1 1.2
VRF Server Status Enabled Services
-------------------------------------------------------
default HTTPS: port 443 http-commands

If Enabled Services in the output shows http-commands, this is a finding.

Vulnerability Number

V-255952

Documentable

False

Rule Version

ARST-ND-000340

Severity Override Guidance

Verify the Arista network device has telnet and https disabled.

Step 1: Determine if telnet is disabled with the following command:

switch#show management telnet

Telnet status for Default VRF is disabled
Telnet session limit is 20
Telnet session limit per host is 20

If telnet is enabled, this is a finding.

Step 2: Determine if https is disabled with the following command:

switch#show management http-server

SSL Profile: none
FIPS Mode: No
QoS DSCP: 0
LogLevel: none
CSP Frame Ancestor: None
TLS Protocols: 1.0 1.1 1.2
VRF Server Status Enabled Services
-------------------------------------------------------
default HTTPS: port 443 http-commands

If Enabled Services in the output shows http-commands, this is a finding.

Check Content Reference

M

Target Key

5511