STIGQter: STIG Summary: Arista MLS EOS 4.X L2S Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Arista MLS layer 2 switch must not have any switch ports assigned to the native VLAN.

DISA Rule

SV-255986r991780_rule

Vulnerability Number

V-255986

Group Title

SRG-NET-000512-L2S-000013

Rule Version

ARST-L2-000230

Severity

CAT III

CCI(s)

• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the Arista MLS switch to ensure all access switch ports use a VLAN other than the native VLAN.

Configure all access switch ports to a VLAN other than the designated native VLAN by using the following example:

switch(config)#interface Ethernet 21
switch(config-Eth21)# switchport access vlan xxxx

Check Contents

Review the configuration for all trunking ports to determine the native VLAN by using the following example (for vlan 1000):

switch(config-if-Et4)#sh run int eth4
interface Ethernet4
description STIG Disable_VLAN 1 and native vlan to 1000
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-999,1001-4094
switch(config-if-Et4)#

Review the configuration to ensure no access switch ports are configured in the native VLAN by using the following example (for vlan 1000):

swtich#sh vlan brief
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active
4090 VLAN4090 active

If any access switch ports have been assigned to the same VLAN ID as the native VLAN, this is a finding.

Vulnerability Number

V-255986

Documentable

False

Rule Version

ARST-L2-000230

Severity Override Guidance

Review the configuration for all trunking ports to determine the native VLAN by using the following example (for vlan 1000):

switch(config-if-Et4)#sh run int eth4
interface Ethernet4
description STIG Disable_VLAN 1 and native vlan to 1000
switchport trunk native vlan 1000
switchport trunk allowed vlan 2-999,1001-4094
switch(config-if-Et4)#

Review the configuration to ensure no access switch ports are configured in the native VLAN by using the following example (for vlan 1000):

swtich#sh vlan brief
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active
4090 VLAN4090 active

If any access switch ports have been assigned to the same VLAN ID as the native VLAN, this is a finding.

Check Content Reference

M

Target Key

5512