STIGQter STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 Arista MLS switch must implement Rapid STP where VLANs span multiple switches with redundant links.

DISA Rule

SV-255977r882273_rule

Vulnerability Number

V-255977

Group Title

SRG-NET-000512-L2S-000003

Rule Version

ARST-L2-000140

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Arista MLS switch for Multiple Spanning-tree (MST) or Rapid STP to be implemented at the access and distribution layers where VLANs span multiple switches.

switch(config)#spanning-tree mode mstp

The Arista MLS switch can alternatively be configured for spanning-tree mode RSTP to support a spanning-tree instance for each VLAN:

switch(config)#
spanning-tree mode rstp
!

Check Contents

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the Arista MLS switch configuration to verify that Rapid STP has been implemented.

switch(config)#sh run | sec spanning-tree
spanning-tree mode rstp
!

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs.

If MSTP or Rapid STP has not been implemented where STP is required, this is a finding.

Vulnerability Number

V-255977

Documentable

False

Rule Version

ARST-L2-000140

Severity Override Guidance

In cases where VLANs do not span multiple switches, it is a best practice to not implement STP. Avoiding the use of STP will provide the most deterministic and highly available network topology. If STP is required, review the Arista MLS switch configuration to verify that Rapid STP has been implemented.

switch(config)#sh run | sec spanning-tree
spanning-tree mode rstp
!

Note: MSTP can be configured as an alternate mode. MSTP uses RSTP for rapid convergence and enables multiple VLANs to be grouped into and mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs.

If MSTP or Rapid STP has not been implemented where STP is required, this is a finding.

Check Content Reference

M

Target Key

5512