STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

DISA Rule

SV-255999r882339_rule

Vulnerability Number

V-255999

Group Title

SRG-NET-000019-RTR-000004

Rule Version

ARST-RT-000130

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Configure neighbor filters to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor filters to all PIM-enabled interfaces.

Step 1: Configure an ACL that will specify the authorized PIM neighbors.

router(config)#ip access-list standard filter_1
router(config-std-acl-filter_1)#permit 10.13.24.9/24
router(config-std-acl-filter_1)#exit

Step 2: Configure a PIM neighbor-filter command and apply it on all PIM-enabled interfaces that are referencing the PIM neighbor ACL.

router(config)#interface vlan 4
router(config-if-Vl4)#pim ipv4 neighbor-filter filter_1
router(config-if-Vl4)#exit

Check Contents

This requirement is not applicable for the DODIN backbone.

Review the Arista router multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.

If the router is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors.

Step 1: Verify the ACL is configured that will specify the authorized PIM neighbors. To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list standard filter_1
permit 10.13.24.9/24
exit

Step 2: Verify the PIM neighbor-filter is configured on PIM-enabled interfaces. To verify interfaces are configured, execute the command "show run int YY".

interface vlan 4
pim ipv4 sparse-mode
pim ipv4 neighbor-filter filter_1
exit

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Vulnerability Number

V-255999

Documentable

False

Rule Version

ARST-RT-000130

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Review the Arista router multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.

If the router is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors.

Step 1: Verify the ACL is configured that will specify the authorized PIM neighbors. To verify IP access lists are configured, execute the command "show ip access-lists".

ip access-list standard filter_1
permit 10.13.24.9/24
exit

Step 2: Verify the PIM neighbor-filter is configured on PIM-enabled interfaces. To verify interfaces are configured, execute the command "show run int YY".

interface vlan 4
pim ipv4 sparse-mode
pim ipv4 neighbor-filter filter_1
exit

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Check Content Reference

M

Target Key

5513