STIGQter STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.

DISA Rule

SV-255961r961557_rule

Vulnerability Number

V-255961

Group Title

SRG-APP-000412-NDM-000331

Rule Version

ARST-ND-000700

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the Arista network device to use FIPS-approved algorithms to protect the confidentiality of remote maintenance sessions.

switch(config)#management ssh
switch(config-mgmt-ssh)#cipher aes256-ctr aes512-ctr aes128-ctr

Check Contents

Validate that a FIPS validated SSH encryption algorithm is selected.

NOTE: AES-CBC algorithms have been considered compromised and are no longer recommended for cryptographic algorithms. AES-CTR and AES-GCM are both superior algorithms and are recommended.

sh run | section management ssh
cipher aes256-ctr aes512-ctr aes128-ctr

If the Arista network device is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Vulnerability Number

V-255961

Documentable

False

Rule Version

ARST-ND-000700

Severity Override Guidance

Validate that a FIPS validated SSH encryption algorithm is selected.

NOTE: AES-CBC algorithms have been considered compromised and are no longer recommended for cryptographic algorithms. AES-CTR and AES-GCM are both superior algorithms and are recommended.

sh run | section management ssh
cipher aes256-ctr aes512-ctr aes128-ctr

If the Arista network device is not configured to implement cryptographic mechanisms to protect the confidentiality of remote maintenance sessions using a FIPS 140-2 approved algorithm, this is a finding.

Check Content Reference

M

Target Key

5511