STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.

DISA Rule

SV-255973r882261_rule

Vulnerability Number

V-255973

Group Title

SRG-NET-000362-L2S-000025

Rule Version

ARST-L2-000090

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the Arista MLS switch to have DHCP snooping enabled globally and for all user VLANs to validate DHCP messages from untrusted sources.

Step 1: Configure DHCP Snooping globally by using the following command:

switch(config)# ip dhcp snooping

Step 2: Configure DHCP Snooping to enable the insertion of option-82 in DHCP request packets. By default, option-82 is not enabled and without this, DHCP Snooping is not operational.

switch(config)#ip dhcp snooping information option

Step 3: Configure the Arista MLS switch to enable IP DHCP Snooping on the corresponding VLANs. By default, DHCP Snooping will not be enabled on any VLAN.

switch(config)#ip dhcp snooping vlan <vlan-id>

Step 4: Configure the following command to set the circuit-id information that will be sent in option-82. By default, Interface name and VLAN ID are sent. Remote circuit-id will always be the MAC address of the relay agent.

switch# ip dhcp snooping information option circuit-id type 2 format
Hostname and interface name
Interface name and VLAN ID

Check Contents

Review the Arista MLS switch configuration and verify that DHCP snooping is enabled on all user VLANs.

Verify the Arista MLS has the DHCP Snooping feature enabled globally by executing "show ip dhcp snooping".

switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
650
DHCP Snooping is operational on following VLANs:
650

If the Arista MLS switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

Vulnerability Number

V-255973

Documentable

False

Rule Version

ARST-L2-000090

Severity Override Guidance

Review the Arista MLS switch configuration and verify that DHCP snooping is enabled on all user VLANs.

Verify the Arista MLS has the DHCP Snooping feature enabled globally by executing "show ip dhcp snooping".

switch(config)# show ip dhcp snooping
DHCP Snooping is enabled
DHCP Snooping is operational
DHCP Snooping is configured on following VLANs:
650
DHCP Snooping is operational on following VLANs:
650

If the Arista MLS switch does not have DHCP snooping enabled for all user VLANs to validate DHCP messages from untrusted sources, this is a finding.

Check Content Reference

M

Target Key

5512