STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

DISA Rule

SV-256019r882399_rule

Vulnerability Number

V-256019

Group Title

SRG-NET-000205-RTR-000005

Rule Version

ARST-RT-000380

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Step 1: Configure an egress ACL bound to the internal interface in an inbound direction to filter traffic leaving the network.

Leaf2(config)#ip access-list WAN_OUT
Leaf2(config-acl-WAN_OUT)#10 permit tcp any host 180.20.10.1 eq ssh telnet
Leaf2(config-acl-WAN_OUT)#20 permit ip any 190.16.10.0/24
Leaf2(config-acl-WAN_OUT)#30 permit udp any host 67.56.10.2 eq bootps snmp
Leaf2(config-acl-WAN_OUT)#40 deny tcp any 208.73.210.0 0.0.1.255
Leaf2(config-acl-WAN_OUT)#50 deny udp any 208.73.210.0 0.0.1.255
Leaf2(config-acl-WAN_OUT)#60 deny icmp any any
Leaf2(config-acl-WAN_OUT)#70 permit ip any any

Step 2: Apply the ACL inbound on all external interfaces.

Leaf2(config)#interface ethernet 8
Leaf2(config-if-Et8)# ip access-group WAN_OUT in

Check Contents

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to verify the egress ACL is bound to the internal interface in an inbound direction.

Step 1: To verify the egress ACL is bound to the internal interface in an inbound direction, execute the command "sh ip access-list".

ip access-list WAN_OUT
10 permit tcp any host 180.20.10.1 eq ssh telnet
20 permit ip any 190.16.10.0/24
30 permit udp any 67.56.10.2 eq bootps snmp
40 deny tcp any 208.73.210.0 0.0.1.255
50 deny udp any 208.73.210.0 0.0.1.255
60 deny icmp any any
70 permit ip any any

Step 2: To verify the ACL is applied inbound on all external interfaces, execute the command "sh run int Eth YY".

interface ethernet 8
ip access-group WAN_OUT in

If the Arista router is not configured to filter traffic leaving the network at the internal interface in an inbound direction, this is a finding.

Vulnerability Number

V-256019

Documentable

False

Rule Version

ARST-RT-000380

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to verify the egress ACL is bound to the internal interface in an inbound direction.

Step 1: To verify the egress ACL is bound to the internal interface in an inbound direction, execute the command "sh ip access-list".

ip access-list WAN_OUT
10 permit tcp any host 180.20.10.1 eq ssh telnet
20 permit ip any 190.16.10.0/24
30 permit udp any 67.56.10.2 eq bootps snmp
40 deny tcp any 208.73.210.0 0.0.1.255
50 deny udp any 208.73.210.0 0.0.1.255
60 deny icmp any any
70 permit ip any any

Step 2: To verify the ACL is applied inbound on all external interfaces, execute the command "sh run int Eth YY".

interface ethernet 8
ip access-group WAN_OUT in

If the Arista router is not configured to filter traffic leaving the network at the internal interface in an inbound direction, this is a finding.

Check Content Reference

M

Target Key

5513