STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

DISA Rule

SV-255998r882336_rule

Vulnerability Number

V-255998

Group Title

SRG-NET-000019-RTR-000003

Rule Version

ARST-RT-000120

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Document all enabled interfaces for PIM in the network's multicast topology diagram. Disable support for PIM on interfaces that are not required to support it.

Step 1: Configure the router in global configuration mode to support multicast routing.

router(config)#router multicast
router(config-router-multicast)#ipv4
router(config-router-multicast-ipv4)#routing
router(config-router-multicast-ipv4)#exit
router(config-router-multicast)#exit

Step 2: Enable PIM on interfaces required to support multicast.

Interfaces have PIM disabled by default. To enable PIM from an interface active in a multicast network, enter "pim sparse-mode" in the interface configuration mode.

router(config)#interface Ethernet1
router(config-if-Et1)#pim ipv4 sparse-mode
router(config-if-Et1)#pim ipv6 sparse-mode

Step 3: Disable support for PIM on interfaces that are not required to support it.

router(config)#interface Ethernet2
router(config-if-Et2)#no pim ipv4 sparse-mode
router(config-if-Et2)#no pim ipv6 sparse-mode

Check Contents

If IPv4 or IPv6 multicast routing is enabled on the Arista router, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram.

Review the Arista router configuration to determine which interfaces are enabled for PIM, identified via the "pim ipv4 sparse-mode" for ipv4 and "pim ipv6 sparse-mode" for ipv6 statement in the interface configuration, and compare to the topology.

sh run | sec pim

interface Ethernet3
pim ipv4 sparse-mode
interface Ethernet8
pim ipv4 sparse-mode
pim ipv6 sparse-mode
interface Ethernet9
pim ipv4 sparse-mode
pim ipv6 sparse-mode
interface Vlan8
pim ipv4 sparse-mode

If an interface is not required to support multicast routing and it is enabled, this is a finding.

Vulnerability Number

V-255998

Documentable

False

Rule Version

ARST-RT-000120

Severity Override Guidance

If IPv4 or IPv6 multicast routing is enabled on the Arista router, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram.

Review the Arista router configuration to determine which interfaces are enabled for PIM, identified via the "pim ipv4 sparse-mode" for ipv4 and "pim ipv6 sparse-mode" for ipv6 statement in the interface configuration, and compare to the topology.

sh run | sec pim

interface Ethernet3
pim ipv4 sparse-mode
interface Ethernet8
pim ipv4 sparse-mode
pim ipv6 sparse-mode
interface Ethernet9
pim ipv4 sparse-mode
pim ipv6 sparse-mode
interface Vlan8
pim ipv4 sparse-mode

If an interface is not required to support multicast routing and it is enabled, this is a finding.

Check Content Reference

M

Target Key

5513