STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have IGMP or MLD Snooping configured on all VLANs.

DISA Rule

SV-255976r882270_rule

Vulnerability Number

V-255976

Group Title

SRG-NET-000512-L2S-000002

Rule Version

ARST-L2-000130

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the Arista MLS switch for IGMP snooping for IPv4 and IPv6 multicast traffic for each VLAN.

Configure the Arista MLS switch for IP PIM, which also enables IGMP on an Arista MLS switch VLAN or interface, by using the following command:

switch(config)#int vlan8
ip igmp
pim ipv4 sparse-mode
pim ipv6 sparse-mode
switch(config)#exit
!

Arista MLS switch alternative configuration for MLD snooping on an interface for version 1 and 2. Version 2 is the default MLD version.

switch(config)# mld snooping
switch(config-mld-snooping)# vlan 200
!

Check Contents

Review the Arista MLS switch configuration to verify that IGMP or MLD snooping has been configured.

Determine which snooping feature is used.

For IGMP:
Verify the PIM that also enables IGMP on an Arista MLS switch VLAN interface by using the "sh run interface vlan8" command:

switch(config)#sh run int vlan8
interface VLAN8
ip igmp
pim ipv4 sparse-mode
switch(config)#exit

For MLD:
Verify the Arista MLS switch is configured for MLD snooping on an interface for version 1 and 2. Version 2 is the default MLD version.

switch#sh run | section mld
mld snooping
vlan 200

If the Arista switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-255976

Documentable

False

Rule Version

ARST-L2-000130

Severity Override Guidance

Review the Arista MLS switch configuration to verify that IGMP or MLD snooping has been configured.

Determine which snooping feature is used.

For IGMP:
Verify the PIM that also enables IGMP on an Arista MLS switch VLAN interface by using the "sh run interface vlan8" command:

switch(config)#sh run int vlan8
interface VLAN8
ip igmp
pim ipv4 sparse-mode
switch(config)#exit

For MLD:
Verify the Arista MLS switch is configured for MLD snooping on an interface for version 1 and 2. Version 2 is the default MLD version.

switch#sh run | section mld
mld snooping
vlan 200

If the Arista switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

5512