STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must not use the default VLAN for management traffic.

DISA Rule

SV-255983r991777_rule

Vulnerability Number

V-255983

Group Title

SRG-NET-000512-L2S-000010

Rule Version

ARST-L2-000200

Severity

CAT II

CCI(s)

CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

Fix Recommendation

Step 1: Configure the Arista MLS switch for a VRF instance for Management Network access by using the following commands:

switch(config)#vrf instance Management_Network
switch(config-vrf-Management_Network)#exit

Step 2: Configure the Ethernet port for VRF Management_Network and IP address for the management network traffic:

switch(config-if-Et12)#vrf Management_Network
switch(config-if-Et12)#ip address 10.10.40.254/30
switch(config-if-Et12)#exit

Check Contents

Verify the Arista MLS configuration for a Management_Network VRF instance globally on the switch with the following example:

switch(config)#sh run | sec vrf
ip name-server vrf default 192.168.10.20
!
vrf instance Management_Network
!
interface Ethernet12
description MANAGEMENT NETWORK PORT
no switchport
vrf Management_Network
ip address 10.10.40.254/30
!
ip routing vrf Management_Network

If the VRF is not configured to prevent the default VLAN from being used to access the switch, this is a finding.

The Arista MLS layer 2 switch must not use the default VLAN for management traffic.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key