STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

DISA Rule

SV-255987r882303_rule

Vulnerability Number

V-255987

Group Title

SRG-NET-000018-RTR-000001

Rule Version

ARST-RT-000010

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Configure the Arista routers to enforce ACLs and filters to allow or deny traffic for specific source and destination addresses as well as ports and protocols for controlling information flow.

To configure an IP access list to fulfill this function, enter the following commands, substituting organizational values for the bracketed variables and values.

Step 1:
Ip access-list [name]
[permit/deny] [protocol] [source address] [source port] [destination address] [destination port]
Exit

Step 2:
Apply the filters inbound or outbound on the appropriate external and internal interfaces.

Interface [type] [number]
Ip access-group [name] [direction]

Note: Policy-based routing can also be implemented if needed.

Check Contents

This requirement is not applicable for the DODIN backbone.

Verify that for the Arista router configuration, access control lists (ACLs) and filters are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols. These filters must be applied inbound or outbound on the appropriate external and internal interfaces.

Example:

router# show ip access-lists

Verify IP access list configuration ACLs and filter are configured to allow or deny specific traffic.

!
ip access-list STIG
10 deny ip 172.16.50.0/30 10.10.100.0/24
20 permit ip any any
!

Verify the IP access list ACLs are applied to the specific Ethernet interface.

!
router# show ethernet Interface Eth3
!
Interface Ethernet 3
description BGP Link to Gateway Router
no router port
ip address 192.168.1.1/30
ip access-group STIG in
!

If the Arista router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Vulnerability Number

V-255987

Documentable

False

Rule Version

ARST-RT-000010

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Verify that for the Arista router configuration, access control lists (ACLs) and filters are configured to allow or deny traffic for specific source and destination addresses as well as ports and protocols. These filters must be applied inbound or outbound on the appropriate external and internal interfaces.

Example:

router# show ip access-lists

Verify IP access list configuration ACLs and filter are configured to allow or deny specific traffic.

!
ip access-list STIG
10 deny ip 172.16.50.0/30 10.10.100.0/24
20 permit ip any any
!

Verify the IP access list ACLs are applied to the specific Ethernet interface.

!
router# show ethernet Interface Eth3
!
Interface Ethernet 3
description BGP Link to Gateway Router
no router port
ip address 192.168.1.1/30
ip access-group STIG in
!

If the Arista router is not configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies, this is a finding.

Check Content Reference

M

Target Key

5513