STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

DISA Rule

SV-255959r961506_rule

Vulnerability Number

V-255959

Group Title

SRG-APP-000395-NDM-000310

Rule Version

ARST-ND-000660

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure the network device to authenticate SNMP messages using a FIPS-validated HMAC.

Configure the Arista network device following the example SNMP parameters to ensure messages are authenticated using FIPS-validated HMAC:

switch(config)#snmp-server engineID local f5717f444ca880dbb200
switch(config)#snmp-server chassis-id ID CC-7050X3
switch(config)#snmp-server contact FedSE
switch(config)#snmp-server location JITC
switch(config)#snmp-server view snmpview system included
switch(config)#snmp-server group testers v3 priv read snmpview
switch(config)#snmp-server user jitc-sw testers v3 localized f8527f444ca990dcc200 auth sha 7b65225a6abf5111cd951e6cb7e105aef5bcd734 priv aes a1aedb1986642e766d4c8032d58e73b72bc3528b
switch(config)#snmp-server host 192.168.10.31 version 3 priv jitc-sw
switch(config)#snmp-server enable traps snmp authentication
switch(config)#snmp-server enable traps snmp link-down
switch(config)#snmp-server enable traps snmp link-up

Check Contents

Review the network device configuration to verify SNMP messages are authenticated using a FIPS-validated HMAC.

Verify the Arista network device is configured for the following SNMP example parameters:

switch(config)#show run | section snmp
snmp-server engineID local f5717f444ca880dbb200
snmp-server chassis-id ID CC-7050X3
snmp-server contact FedSE
snmp-server location JITC
snmp-server view snmpview system included
snmp-server group testers v3 priv read snmpview
snmp-server user jitc-sw testers v3 localized f8527f444ca990dcc200 auth sha 7b65225a6abf5111cd951e6cb7e105aef5bcd734 priv aes a1aedb1986642e766d4c8032d58e73b72bc3528b
snmp-server host 192.168.10.31 version 3 priv jitc-sw
snmp-server enable traps snmp authentication
snmp-server enable traps snmp link-down
snmp-server enable traps snmp link-up
!

If the Arista network device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Vulnerability Number

V-255959

Documentable

False

Rule Version

ARST-ND-000660

Severity Override Guidance

Review the network device configuration to verify SNMP messages are authenticated using a FIPS-validated HMAC.

Verify the Arista network device is configured for the following SNMP example parameters:

switch(config)#show run | section snmp
snmp-server engineID local f5717f444ca880dbb200
snmp-server chassis-id ID CC-7050X3
snmp-server contact FedSE
snmp-server location JITC
snmp-server view snmpview system included
snmp-server group testers v3 priv read snmpview
snmp-server user jitc-sw testers v3 localized f8527f444ca990dcc200 auth sha 7b65225a6abf5111cd951e6cb7e105aef5bcd734 priv aes a1aedb1986642e766d4c8032d58e73b72bc3528b
snmp-server host 192.168.10.31 version 3 priv jitc-sw
snmp-server enable traps snmp authentication
snmp-server enable traps snmp link-down
snmp-server enable traps snmp link-up
!

If the Arista network device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Check Content Reference

M

Target Key

5511