STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

DISA Rule

SV-255956r991784_rule

Vulnerability Number

V-255956

Group Title

SRG-APP-000190-NDM-000267

Rule Version

ARST-ND-000490

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure the Arista network device to terminate the connections after 10 minutes of inactivity.

Step 1: Configure the settings for the console.

switch(config)#management console
switch(config-mgmt-console)#idle-timeout 10
switch(config-mgmt-console)#exit
switch(config)#
!

Step 2: Configure the settings for SSH.

switch(config)#management ssh
switch(config-mgmt-ssh)#idle-timeout 10
switch(config-mgmt-console)#exit
switch(config)#
!

Check Contents

Verify the Arista device is configured for 10-minute inactivity timeout for management sessions.

switch#sh run | section management
!
interface Management1
ip address 172.28.134.55/20
!
management console
idle-timeout 10
!
management ssh
idle-timeout 10
!

If the Arista network device is not configured to terminate the connection associated with a device management session at the end of the session or after 10 minutes of inactivity, this is a finding.

Vulnerability Number

V-255956

Documentable

False

Rule Version

ARST-ND-000490

Severity Override Guidance

Verify the Arista device is configured for 10-minute inactivity timeout for management sessions.

switch#sh run | section management
!
interface Management1
ip address 172.28.134.55/20
!
management console
idle-timeout 10
!
management ssh
idle-timeout 10
!

If the Arista network device is not configured to terminate the connection associated with a device management session at the end of the session or after 10 minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

5511