STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

DISA Rule

SV-256025r991788_rule

Vulnerability Number

V-256025

Group Title

SRG-NET-000205-RTR-000012

Rule Version

ARST-RT-000440

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.
• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

If the Arista management interface is a routed interface, it must be configured with both an ingress and egress ACL.

Step 1: Configure the ingress filter to only allow management, IGP, and ICMP traffic.

LEAF-1A(config)#ip access-list FILTER_INBOUND
LEAF-1A(config-acl-FILTER_INBOUND)#permit ospf any any
LEAF-1A(config-acl-FILTER_INBOUND)#permit icmp any any echo
LEAF-1A(config-acl-FILTER_INBOUND)#permit icmp any any echo-reply
LEAF-1A(config-acl-FILTER_INBOUND)#permit ip 10.10.10.0/24 any
LEAF-1A(config-acl-FILTER_INBOUND)#deny ip any any log

Step 2: Configure the outbound filter to only allow management, IGP, and ICMP traffic.

LEAF-1A(config)#ip access-list FILTER_OUTBOUND
LEAF-1A(config-acl-FILTER_OUTBOUND)#permit ospf any any
LEAF-1A(config-acl-FILTER_OUTBOUND)#permit icmp any any echo
LEAF-1A(config-acl-FILTER_OUTBOUND)#permit icmp any any echo-reply
LEAF-1A(config-acl-FILTER_OUTBOUND)#permit ip any 10.10.10.0/24
LEAF-1A(config-acl-FILTER_OUTBOUND)#deny ip any any log

Step 3: Set the managed interface to have an inbound and outbound ACL configured.

LEAF-1A(config)#interface ethernet 3
LEAF-1A(config-if-Et3)# ip access-group FILTER_INBOUND in
LEAF-1A(config-if-Et3)# ip access-group FILTER_OUTBOUND out

Check Contents

Step 1: To verify the Arista router managed interface has an inbound and outbound ACL configured, execute "show run int Eth YY".

router#show interface Ethernet 3
interface ethernet 3
ip access-group FILTER_INBOUND in
ip access-group FILTER_OUTBOUND out

Step 2: To verify the ingress filter only allows management, IGP, and ICMP traffic, execute "show ip access-list".

router#show ip access-list
ip access-list FILTER_INBOUND
10 permit ospf any any
20 permit icmp any any echo
30 permit icmp any any echo-reply
40 permit ip 10.10.10.0/24 any
50 deny ip any any log
!
ip access-list FILTER_OUTBOUND
10 permit ospf any any
20 permit icmp any any echo
30 permit icmp any any echo-reply
40 permit ip any 10.10.10.0/24
50 deny ip any any log
!

Note: If the management interface is a true OOBM interface, this requirement is not applicable.

If the Arista router does not restrict traffic that ingresses and egresses the management interface, this is a finding.

Vulnerability Number

V-256025

Documentable

False

Rule Version

ARST-RT-000440

Severity Override Guidance

Step 1: To verify the Arista router managed interface has an inbound and outbound ACL configured, execute "show run int Eth YY".

router#show interface Ethernet 3
interface ethernet 3
ip access-group FILTER_INBOUND in
ip access-group FILTER_OUTBOUND out

Step 2: To verify the ingress filter only allows management, IGP, and ICMP traffic, execute "show ip access-list".

router#show ip access-list
ip access-list FILTER_INBOUND
10 permit ospf any any
20 permit icmp any any echo
30 permit icmp any any echo-reply
40 permit ip 10.10.10.0/24 any
50 deny ip any any log
!
ip access-list FILTER_OUTBOUND
10 permit ospf any any
20 permit icmp any any echo
30 permit icmp any any echo-reply
40 permit ip any 10.10.10.0/24
50 deny ip any any log
!

Note: If the management interface is a true OOBM interface, this requirement is not applicable.

If the Arista router does not restrict traffic that ingresses and egresses the management interface, this is a finding.

Check Content Reference

M

Target Key

5513