STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.

DISA Rule

SV-255975r882267_rule

Vulnerability Number

V-255975

Group Title

SRG-NET-000362-L2S-000027

Rule Version

ARST-L2-000110

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the Arista MLS switch to have static Address Resolution Protocol (ARP) Inspection to be enabled on all user VLANs.

By default, Arista MLS switch static ARP Inspection is disabled on all VLANs. Static ARP inspection can be enabled on all specific user VLANs by using the following command:

switch(config)#ip arp inspection vlan <vlan-list>

Check Contents

Review the Arista MLS switch configuration to verify that Dynamic Address Resolution Protocol (ARP) Inspection (DAI) feature is enabled on all user VLANs.

Verify ARP inspection for user VLANs by the following command:

sh ip arp inspection vlan

VLAN 2200
------------
Configuration: Enabled
Operation State: Active

If static ARP inspection is not enabled on all user VLANs, this is a finding.

Vulnerability Number

V-255975

Documentable

False

Rule Version

ARST-L2-000110

Severity Override Guidance

Review the Arista MLS switch configuration to verify that Dynamic Address Resolution Protocol (ARP) Inspection (DAI) feature is enabled on all user VLANs.

Verify ARP inspection for user VLANs by the following command:

sh ip arp inspection vlan

VLAN 2200
------------
Configuration: Enabled
Operation State: Active

If static ARP inspection is not enabled on all user VLANs, this is a finding.

Check Content Reference

M

Target Key

5512