STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must be configured for Storm Control to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-255969r991773_rule

Vulnerability Number

V-255969

Group Title

SRG-NET-000193-L2S-000020

Rule Version

ARST-L2-000030

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

The Arista MLS switch must be configured to implement a storm-control policy for traffic prioritization and bandwidth reservation.

Storm-control on switch Ethernet interfaces can be configured to limit the packets based on broadcast, multicast, and unknown-unicast traffic:

switch#configure
switch(config)#internet et[X]
interface Ethernet[X] 
switchport
   storm-control broadcast level pps 5000
   storm-control multicast level pps 5000
   storm-control unknown-unicast level pps 5000

Check Contents

Verify the Arista MLS switch is configured for storm-control on applicable Ethernet interfaces.

switch#show storm-control
Port Type Level Rate(Mbps) Status Drops Reason
Et10/2 all 75 7500 active 0
Et4 multicast 55 5500 active 0
Et4 broadcast 50 5000 active
switch#

If the Arista MLS switch is not configured to implement a storm-control policy, this is a finding.

Vulnerability Number

V-255969

Documentable

False

Rule Version

ARST-L2-000030

Severity Override Guidance

Verify the Arista MLS switch is configured for storm-control on applicable Ethernet interfaces.

switch#show storm-control
Port Type Level Rate(Mbps) Status Drops Reason
Et10/2 all 75 7500 active 0
Et4 multicast 55 5500 active 0
Et4 broadcast 50 5000 active
switch#

If the Arista MLS switch is not configured to implement a storm-control policy, this is a finding.

Check Content Reference

M

Target Key

5512