STIGQter STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

DISA Rule

SV-255996r945855_rule

Vulnerability Number

V-255996

Group Title

SRG-NET-000018-RTR-000010

Rule Version

ARST-RT-000100

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the Arista router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Configure the as-path access-list to filter the updates from the CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

router (config) # ip as-path regex-mode asn
router (config) # ip as-path access-list NEIGHBOR_PATH permit ^35121$ any
router (config) # ip as-path access-list NEIGHBOR_PATH deny .* any

Step 2: Configure the route-map and match the as-path access-list.

route-map TrafficOtherAS_Path permit 10
match as-path NEIGHBOR_PATH

Step 3: Apply the route-map to the appropriate neighbor.

router (config) # router bgp 65000
router (config-router-bgp) #neighbor 10.1.12.2 route-map TrafficOtherAS_Path in

Check Contents

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Review the router configuration and verify an as-path access-list statement is defined to only accept routes from a CE router whose AS did not originate the route.

show ip as-path access-list

ip as-path regex-mode asn
ip as-path access-list NEIGHBOR_PATH permit ^35121$ any
ip as-path access-list NEIGHBOR_PATH deny .* any

Step 2: Verify the as-path access list is referenced by the filter-list inbound for the appropriate BGP neighbors.

The filter-list CLI is not supported in Arista MLS. The workaround with route-map follows:

route-map TrafficOtherAS_Path permit 10
match as-path NEIGHBOR_PATH

Step 3: To verify the BGP config and verifying the route map is applied inbound execute the command "show run | sec router bgp".

router bgp 65000
neighbor 10.1.12.2 route-map TrafficOtherAS_Path in

If the Arista router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Vulnerability Number

V-255996

Documentable

False

Rule Version

ARST-RT-000100

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Review the router configuration and verify an as-path access-list statement is defined to only accept routes from a CE router whose AS did not originate the route.

show ip as-path access-list

ip as-path regex-mode asn
ip as-path access-list NEIGHBOR_PATH permit ^35121$ any
ip as-path access-list NEIGHBOR_PATH deny .* any

Step 2: Verify the as-path access list is referenced by the filter-list inbound for the appropriate BGP neighbors.

The filter-list CLI is not supported in Arista MLS. The workaround with route-map follows:

route-map TrafficOtherAS_Path permit 10
match as-path NEIGHBOR_PATH

Step 3: To verify the BGP config and verifying the route map is applied inbound execute the command "show run | sec router bgp".

router bgp 65000
neighbor 10.1.12.2 route-map TrafficOtherAS_Path in

If the Arista router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Check Content Reference

M

Target Key

5513