STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

DISA Rule

SV-255985r991779_rule

Vulnerability Number

V-255985

Group Title

SRG-NET-000512-L2S-000012

Rule Version

ARST-L2-000220

Severity

CAT II

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the interface trunk ports for the unique Native VLAN ID and configure the VLAN allowed by using the following commands:

switch(config)#interface Ethernet10
switch(config-eth10)#description #STIG VLAN 1 Pruning
switch(config-eth10)# switchport trunk native vlan 1000
switch(config-eth10)#switchport trunk allowed vlan 2-4094

Check Contents

Review the Arista MLS switch configuration for all trunk ports to have a unique native VLAN ID that is not the default VLAN 1 by using the following example:

switch(config)#sh run | sec native vlan
interface Ethernet4
description STIG Disable_VLAN 1 and native vlan to 1000
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-4094

If the native VLAN has the same VLAN ID as the default VLAN, this is a finding.

Vulnerability Number

V-255985

Documentable

False

Rule Version

ARST-L2-000220

Severity Override Guidance

Review the Arista MLS switch configuration for all trunk ports to have a unique native VLAN ID that is not the default VLAN 1 by using the following example:

switch(config)#sh run | sec native vlan
interface Ethernet4
description STIG Disable_VLAN 1 and native vlan to 1000
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-4094

If the native VLAN has the same VLAN ID as the default VLAN, this is a finding.

Check Content Reference

M

Target Key

5512