STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have all disabled switch ports assigned to an unused VLAN.

DISA Rule

SV-255980r991774_rule

Vulnerability Number

V-255980

Group Title

SRG-NET-000512-L2S-000007

Rule Version

ARST-L2-000170

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure all Arista MLS switch ports not in use to be shut down and assigned to an unused VLAN.

Step 1: Configure all unused ports to be shut down and assigned to an unused VLAN.

switch(config)#interface ethernet 9
switch(config-eth9)#shutdown
switch(config-eth9)# description this port is intentionally shutdown
switch(config-eth9)# switchport access vlan 999

Step 2: Configure any trunk links to exclude the unused VLAN.

switch(config)# interface ethernet 10
switch(config-eth10)# switchport trunk native vlan 1000
switch(config-eth9)# switchport trunk allowed vlan 2-998, 1001-4094
switch(config-eth9)# switchport mode trunk

Check Contents

Step 1: Review the switch configuration and examine all access switch ports. Verify the unused port is configured to be intentionally shut down and assigned to an inactive VLAN.

switch(config)#sh run int eth8
interface Ethernet8
description PORT IS INTENTIONALLY SHUTDOWN
switchport access vlan 999
shutdown
switch(config)#

Step 2: Verify traffic from the inactive VLAN is not allowed on any trunk links as shown in the example below:

switch(config)#sh run int eth9
interface Ethernet9
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-998, 1001-4094
switchport mode trunk
switch(config)#

If any access switch ports are not in use and not in an inactive shutdown, this is a finding.

Note: Switch ports configured for 802.1x are exempt from this requirement.

Vulnerability Number

V-255980

Documentable

False

Rule Version

ARST-L2-000170

Severity Override Guidance

Step 1: Review the switch configuration and examine all access switch ports. Verify the unused port is configured to be intentionally shut down and assigned to an inactive VLAN.

switch(config)#sh run int eth8
interface Ethernet8
description PORT IS INTENTIONALLY SHUTDOWN
switchport access vlan 999
shutdown
switch(config)#

Step 2: Verify traffic from the inactive VLAN is not allowed on any trunk links as shown in the example below:

switch(config)#sh run int eth9
interface Ethernet9
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-998, 1001-4094
switchport mode trunk
switch(config)#

If any access switch ports are not in use and not in an inactive shutdown, this is a finding.

Note: Switch ports configured for 802.1x are exempt from this requirement.

Check Content Reference

M

Target Key

5512