STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista Multicast Source Discovery Protocol (MSDP) router must be configured to filter received source-active multicast advertisements for any undesirable multicast groups and sources.

DISA Rule

SV-255993r882321_rule

Vulnerability Number

V-255993

Group Title

SRG-NET-000018-RTR-000007

Rule Version

ARST-RT-000070

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Step 1: Configure the Arista router to implement policy to filter multicast advertisements for undesirable multicast groups and sources.

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER

Step 2: Configure the source active access-list.

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

Check Contents

Review the Arista router configuration to determine if there is an import policy to block source-active multicast advertisements for any undesirable multicast groups, as well as any (S, G) states with undesirable source addresses.

Step 1: Verify that an inbound source-active filter is bound to each MSDP peer.

To verify the MSDP peer is configured and the source-active filter is configured inbound, execute the command "show run | sec router msdp".

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER

Step 2: Review the access lists referenced by the source-active filter to verify that undesirable multicast groups, auto-RP, single source multicast (SSM) groups, and advertisements from undesirable sources are blocked.

To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

If the router is not configured with an import policy to block undesirable SA multicast advertisements, this is a finding.

Vulnerability Number

V-255993

Documentable

False

Rule Version

ARST-RT-000070

Severity Override Guidance

Review the Arista router configuration to determine if there is an import policy to block source-active multicast advertisements for any undesirable multicast groups, as well as any (S, G) states with undesirable source addresses.

Step 1: Verify that an inbound source-active filter is bound to each MSDP peer.

To verify the MSDP peer is configured and the source-active filter is configured inbound, execute the command "show run | sec router msdp".

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER

Step 2: Review the access lists referenced by the source-active filter to verify that undesirable multicast groups, auto-RP, single source multicast (SSM) groups, and advertisements from undesirable sources are blocked.

To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

If the router is not configured with an import policy to block undesirable SA multicast advertisements, this is a finding.

Check Content Reference

M

Target Key

5513