STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

DISA Rule

SV-255994r882324_rule

Vulnerability Number

V-255994

Group Title

SRG-NET-000018-RTR-000008

Rule Version

ARST-RT-000080

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Step 1: Configure Arista router to ensure an export policy is implemented on all MSDP routers to avoid global visibility of local multicast (S,G) states.

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER

Step 2: Configure the source active access-list.

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

Check Contents

Review the Arista router configuration to determine if there is export policy to block local source-active multicast advertisements.

Step 1: Verify that an outbound source-active filter is bound to each MSDP peer.

To verify the MSDP peer is configured and to verify the source-active filter is configured outbound, execute the command "show ip msdp peer X.1.12.2 and show ip msdp summary".

router msdp
peer 10.1.12.2
sa-filter out PIM_NEIGHBOR_SA_FILTER

Step 2: Review the access lists referenced by the source-active filters and verify that MSDP source-active messages being sent to MSDP peers do not leak advertisements that are local.

To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

If the router is not configured with an export policy to block local source-active multicast advertisements, this is a finding.

Vulnerability Number

V-255994

Documentable

False

Rule Version

ARST-RT-000080

Severity Override Guidance

Review the Arista router configuration to determine if there is export policy to block local source-active multicast advertisements.

Step 1: Verify that an outbound source-active filter is bound to each MSDP peer.

To verify the MSDP peer is configured and to verify the source-active filter is configured outbound, execute the command "show ip msdp peer X.1.12.2 and show ip msdp summary".

router msdp
peer 10.1.12.2
sa-filter out PIM_NEIGHBOR_SA_FILTER

Step 2: Review the access lists referenced by the source-active filters and verify that MSDP source-active messages being sent to MSDP peers do not leak advertisements that are local.

To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

If the router is not configured with an export policy to block local source-active multicast advertisements, this is a finding.

Check Content Reference

M

Target Key

5513