STIGQter STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must not have the default VLAN assigned to any host-facing switch ports.

DISA Rule

SV-255981r991775_rule

Vulnerability Number

V-255981

Group Title

SRG-NET-000512-L2S-000008

Rule Version

ARST-L2-000180

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Arista MLS switch to remove the assignment of the default VLAN from all access switch ports.

Step 1: Configure the Default VLAN 1 to shut down by using the following command:

switch:(config#)interface vlan 1
switch(config-int-vlan1)#shutdown

Step 2: Configure all access switch ports to be placed in a VLAN other than the default (1):

switch(config)#interface ethernet 8
switch(config-eth8)#switchport access vlan 1000
switch(config-eth8)#exit

Check Contents

Review the Arista MLS switch configurations and verify no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1).

switch(config)#sh vlan
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active Eth1, Eth2

If access switch ports are assigned to the default VLAN, this is a finding.

Vulnerability Number

V-255981

Documentable

False

Rule Version

ARST-L2-000180

Severity Override Guidance

Review the Arista MLS switch configurations and verify no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1).

switch(config)#sh vlan
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active Eth1, Eth2

If access switch ports are assigned to the default VLAN, this is a finding.

Check Content Reference

M

Target Key

5512