STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The MPLS router with RSVP-TE enabled must be configured with message pacing or refresh reduction to adjust maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core routers.

DISA Rule

SV-256011r882375_rule

Vulnerability Number

V-256011

Group Title

SRG-NET-000193-RTR-000001

Rule Version

ARST-RT-000290

Severity

CAT III

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure the router for Refresh Overhead Reduction if using RSVP.

Refresh Overhead Reduction (RFC 2961) can be enabled to support sending message IDs and refreshing state with refresh messages by setting the refresh method to "bundled".

(config-mpls-rsvp)# no shutdown
(config-mpls-rsvp)# refresh method bundled

This is also the default setting. The above command will reset back to default.

Check Contents

Arista MLS router by default protects RSVP bandwidth by using Refresh Overhead Reduction (RFC 2961).

Review the router configuration to verify the router has been configured to prevent a burst of RSVP traffic engineering signaling messages from overflowing the input queue of any neighbor core router.

The command "refresh method bundled" is the default and enabled, and will not show up in the configuration. However, it can be turned off by "refresh method explicit".

sh run | sec mpls rsvp

mpls rsvp
refresh method explicit
no shutdown

If the Arista router is configured with "refresh method explicit" to disable Refresh Overhead Reduction, this is a finding.

Vulnerability Number

V-256011

Documentable

False

Rule Version

ARST-RT-000290

Severity Override Guidance

Arista MLS router by default protects RSVP bandwidth by using Refresh Overhead Reduction (RFC 2961).

Review the router configuration to verify the router has been configured to prevent a burst of RSVP traffic engineering signaling messages from overflowing the input queue of any neighbor core router.

The command "refresh method bundled" is the default and enabled, and will not show up in the configuration. However, it can be turned off by "refresh method explicit".

sh run | sec mpls rsvp

mpls rsvp
refresh method explicit
no shutdown

If the Arista router is configured with "refresh method explicit" to disable Refresh Overhead Reduction, this is a finding.

Check Content Reference

M

Target Key

5513