STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have all trunk links enabled statically.

DISA Rule

SV-255979r882279_rule

Vulnerability Number

V-255979

Group Title

SRG-NET-000512-L2S-000005

Rule Version

ARST-L2-000160

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure static Ethernet interfaces for switchport trunk mode. Ensure required VLAN member tagged traffic is allowed and all other VLAN traffic will be dropped unless an associated untagged native VLAN for the Ethernet interface is allowed.

switch#configure
switch(config)#interface Ethernet6
description STIG Static Trunk
speed forced 10000full
switchport trunk native vlan 2102
switchport trunk allowed vlan 2100-2102
switchport mode trunk
!
switch(config)#interface Ethernet7
description STIG Static Trunk
speed forced 10000full
switchport trunk native vlan 3102
switchport trunk allowed vlan 3100-3102
switchport mode trunk
!

Check Contents

Review the Arista MLS switch configuration to verify that all Ethernet interfaces designated as trunk links are statically configured to specify only member tagged VLAN traffic is allowed and all nonmember VLAN traffic will be dropped unless untagged traffic is associated with the interface's native VLAN.

switch#show run | section trunk
!
interface Ethernet6
description STIG Static Trunk
speed forced 10000full
switchport trunk native vlan 2102
switchport trunk allowed vlan 2100-2102
switchport mode trunk
!

If trunk negotiation is enabled on any interface, this is a finding.

The Arista MLS layer 2 switch must have all trunk links enabled statically.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key