STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.

DISA Rule

SV-256000r882342_rule

Vulnerability Number

V-256000

Group Title

SRG-NET-000019-RTR-000005

Rule Version

ARST-RT-000140

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Step 1: Configure the Arista router ACL to deny packets with multicast administratively scoped destination addresses.

router(config)#ip access-list standard mbac1
router(config-std-acl-mbac1)#10 deny 239.120.10.0/24
router(config-std-acl-mbac1)#20 permit 224.0.0.0/4
router(config-std-acl-mbac1)#exit

Step 2: Apply the multicast boundary at the appropriate interfaces.

router(config)#interface vlan 200
router(config-if-Vl200)#multicast ipv4 boundary mbac1 out
router(config-if-Vl200)#exit

Check Contents

Review the Arista router configuration and verify that admin-scope multicast traffic is blocked at the external edge.

Step 1: Verify the Arista router ACL is configured to deny packets with multicast administratively scoped destination addresses and verify IP access lists are configured. Execute the command "show ip access-lists".

ip access-list standard mbac1
10 deny 239.120.10.0/24
20 permit 224.0.0.0/4
exit

Step 2: Verify the ACL is applied on the multicast boundary at the appropriate interfaces and verify interfaces are configured. Execute the command "show run int YY".

interface vlan 200
multicast ipv4 boundary mbac1 out
exit

If the Arista router is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.

Vulnerability Number

V-256000

Documentable

False

Rule Version

ARST-RT-000140

Severity Override Guidance

Review the Arista router configuration and verify that admin-scope multicast traffic is blocked at the external edge.

Step 1: Verify the Arista router ACL is configured to deny packets with multicast administratively scoped destination addresses and verify IP access lists are configured. Execute the command "show ip access-lists".

ip access-list standard mbac1
10 deny 239.120.10.0/24
20 permit 224.0.0.0/4
exit

Step 2: Verify the ACL is applied on the multicast boundary at the appropriate interfaces and verify interfaces are configured. Execute the command "show run int YY".

interface vlan 200
multicast ipv4 boundary mbac1 out
exit

If the Arista router is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.

Check Content Reference

M

Target Key

5513