STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have BPDU Guard enabled on all switch ports connecting to access layer switches and hosts.

DISA Rule

SV-255971r882255_rule

Vulnerability Number

V-255971

Group Title

SRG-NET-000362-L2S-000022

Rule Version

ARST-L2-000060

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

The Arista MLS switch provides the capability to configure "spanning-tree bpduguard". Configure the Ethernet interface commands:

config 
interface Ethernet[X] 
switch(config)#interface ethernet [X]
switch(config-if-Et[X])#spanning-tree bpduguard enabled
switch(config-if-Et[X])

Check Contents

Review the Arista MLS to verify that BPDU Guard is enabled on all user-facing or untrusted access switch ports.

switch#show run | section bpdu
interface Ethernet37
spanning-tree bpduguard enable

If the Arista MLS switch has not enabled BPDU Guard, this is a finding.

Vulnerability Number

V-255971

Documentable

False

Rule Version

ARST-L2-000060

Severity Override Guidance

Review the Arista MLS to verify that BPDU Guard is enabled on all user-facing or untrusted access switch ports.

switch#show run | section bpdu
interface Ethernet37
spanning-tree bpduguard enable

If the Arista MLS switch has not enabled BPDU Guard, this is a finding.

Check Content Reference

M

Target Key

5512