STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it.

DISA Rule

SV-255982r991776_rule

Vulnerability Number

V-255982

Group Title

SRG-NET-000512-L2S-000009

Rule Version

ARST-L2-000190

Severity

CAT II

CCI(s)

CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

Fix Recommendation

Best practice for VLAN-based networks is to configure Arista MLS switch to prune unnecessary trunk links from gaining access to the default VLAN and ensure frames belonging to the default VLAN do not traverse trunks not requiring frames from the VLAN.

Step 1: Configure the Arista MLS switch to ensure VLAN1 is pruned from all trunk and access ports that do not require it by using the following commands:

switch(config)#vlan 1
switch(config-vlan-1)#show active
switch(config-vlan-1)#sh act
vlan
!! STIG suspend vlan 1 #state suspend vlan 1
switch(config-vlan-1)#exit

Step 2: Configure the Arista MLS switch to allow VLAN trunking except default VLAN 1 and configure Ethernet port 1 to change the native VLAN to 1000.

switch(config)#interface e10
switch(config-eth1o)#switchport trunk native vlan 1000
switch(config-eth1)#switchport trunk allowed vlan except 1

Step 3: Alternatively, the Arista MLS switch can use trunk groups to determine which trunks service which VLANs:

switch(config)#vlan 1
switch(config-vlan-1)#trunk group DO_NOT_USE
switch(config-vlan-1)#sh act
vlan
!! STIG suspend vlan 1 #state suspend vlan 1
trunk group DO_NOT_USE
hss474.10:51:12(config-vlan-1)#

Step 4: On Arista MLS switch, ensure any unnecessary trunk links have not gained access to default VLAN 1; this can be verified with the command "show vlan brief":

switch(config)#sh vlan brief
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active Eth1, Eth15, Eth16, Eth17
4090 VLAN4090 active Eth2, Eth20, Eth32

Check Contents

Review the Arista MLS switch configuration and verify the default VLAN is pruned from trunk links that do not require it.

Step 1: Review the Arista MLS switch configuration by using the following commands to ensure the default VLAN 1 state is suspended:

switch(config)#vlan 1
switch(config-vlan-1)#sh act
vlan
!! STIG suspend vlan 1 #state suspend vlan 1
switch(config-vlan-1)#exit

Step 2: Review the configuration to ensure default VLAN 1 is pruned from any trunk active links by using the command "show vlan brief":

switch(config-vlan-4090)#
switch(config-vlan-4090)#sh vlan brie
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active
4090 VLAN4090 active

If the default VLAN state is not suspended and pruned from trunk links that should not be transporting frames for the VLAN, this is a finding.

The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key