STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have all user-facing or untrusted ports configured as access switch ports.

DISA Rule

SV-255984r991778_rule

Vulnerability Number

V-255984

Group Title

SRG-NET-000512-L2S-000011

Rule Version

ARST-L2-000210

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the Arista MLS switch to disable trunking on all user-facing or untrusted switch ports.

switch{config)#interface ethernet 13 - 15
switch(config-if-Et13-15)#description disable trunking untrusted ports
switch(config-if-Et13-15)#switchport mode access
switch(config-if-Et13-15)#exit

Check Contents

Review the Arista MLS switch configurations and examine all user-facing or untrusted switch ports configured as access switch ports.

switch(config)# show run interface ethernet 13 - 15
interface Ethernet13
switchport access vlan 100
interface Ethernet14
switchport access vlan 100
interface Ethernet14
switchport access vlan 100

If any of the user-facing switch ports are configured as a trunk, this is a finding.

Vulnerability Number

V-255984

Documentable

False

Rule Version

ARST-L2-000210

Severity Override Guidance

Review the Arista MLS switch configurations and examine all user-facing or untrusted switch ports configured as access switch ports.

switch(config)# show run interface ethernet 13 - 15
interface Ethernet13
switchport access vlan 100
interface Ethernet14
switchport access vlan 100
interface Ethernet14
switchport access vlan 100

If any of the user-facing switch ports are configured as a trunk, this is a finding.

Check Content Reference

M

Target Key

5512