STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to synchronize internal system clocks using redundant authenticated time sources.

DISA Rule

SV-255958r1015711_rule

Vulnerability Number

V-255958

Group Title

SRG-APP-000373-NDM-000298

Rule Version

ARST-ND-000600

Severity

CAT II

CCI(s)

• CCI-001889 - Record time stamps for audit records that meet organization-defined granularity of time measurement.
• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
• CCI-004928 - Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.
• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
• CCI-004922 - Synchronize system clocks within and between systems or system components.
• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.

Weight

10

Fix Recommendation

Configure the Arista network device for at least two trusted time sources and to use cryptographic authentication with the following command example:

switch#config
switch(config)#ntp authentication-key 12 sha1 0 <key>
switch(config)#ntp trusted-key 12
switch(config)#ntp authenticate servers
switch(config)#ntp local-interface Management1
switch(config)#ntp server 192.168.16.36 prefer key 12
switch(config)#ntp server 192.168.16.37 key 12
switch(config)#exit

Configure the local time zone for the device.

switch#config
switch(config)#clock timezone <timezone>
switch(config)#exit

Check Contents

Determine if the network device is configured to synchronize internal information system clocks with authenticated primary and secondary time sources.

Verify the Arista network device configuration with the following example:

switch# show running-config | section ntp

ntp authentication-key 12 sha1 7 06131C2058470A58
ntp trusted-key 12
ntp authenticate servers
ntp local-interface Management1
ntp server 192.168.16.36 prefer key 12
ntp server 192.168.16.37 key 12

If the Arista network device is not configured to synchronize internal system clocks with the primary and secondary time sources, this is a finding.

If the Arista network device does not authenticate Network Time Protocol sources using authentication that is cryptographically based, this is a finding.

Vulnerability Number

V-255958

Documentable

False

Rule Version

ARST-ND-000600

Severity Override Guidance

Determine if the network device is configured to synchronize internal information system clocks with authenticated primary and secondary time sources.

Verify the Arista network device configuration with the following example:

switch# show running-config | section ntp

ntp authentication-key 12 sha1 7 06131C2058470A58
ntp trusted-key 12
ntp authenticate servers
ntp local-interface Management1
ntp server 192.168.16.36 prefer key 12
ntp server 192.168.16.37 key 12

If the Arista network device is not configured to synchronize internal system clocks with the primary and secondary time sources, this is a finding.

If the Arista network device does not authenticate Network Time Protocol sources using authentication that is cryptographically based, this is a finding.

Check Content Reference

M

Target Key

5511