STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The PE router providing MPLS Layer 2 Virtual Private Network (L2VPN) services must be configured to authenticate targeted Label Distribution Protocol (LDP) sessions used to exchange virtual circuit (VC) information using a FIPS-approved message authentication code algorithm.

DISA Rule

SV-256028r882426_rule

Vulnerability Number

V-256028

Group Title

SRG-NET-000343-RTR-000001

Rule Version

ARST-RT-000480

Severity

CAT II

CCI(s)

• CCI-001958 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

Implement authentication for all targeted LDP sessions using a FIPS-approved message authentication code algorithm.

Step 1: Configure the mpls LDP on the Arista MLS.

PE11(config)#mpls ldp
PE11(config-mpls-ldp)#router-id interface Loopback0
PE11(config-mpls-ldp)#no shutdown

Step 2: Enable the authentication for LDP neighbors.

PE11(config-mpls-ldp)#password 0 xxxxx

Check Contents

Review the Arista router configuration to determine if LDP messages are being authenticated for the targeted LDP sessions.

Step 1: Verify the Arista router configuration to verify LDP is configured globally and router-id is set.

mpls ldp
router-id [x.x.x.x | interface] LoopbackY
no shutdown

Step 2: Verify the Arista router configuration to ensure the password is configured for LDP neighbor.

mpls ldp
password [type] [password]

Step 3: Enable the mpls globally or per interface.

For Global:

mpls ip

For interfaces:

interface Ethernet 1
mpls ip

If authentication is not being used for the LDP sessions using a FIPS-approved message authentication code algorithm, this is a finding.

Vulnerability Number

V-256028

Documentable

False

Rule Version

ARST-RT-000480

Severity Override Guidance

Review the Arista router configuration to determine if LDP messages are being authenticated for the targeted LDP sessions.

Step 1: Verify the Arista router configuration to verify LDP is configured globally and router-id is set.

mpls ldp
router-id [x.x.x.x | interface] LoopbackY
no shutdown

Step 2: Verify the Arista router configuration to ensure the password is configured for LDP neighbor.

mpls ldp
password [type] [password]

Step 3: Enable the mpls globally or per interface.

For Global:

mpls ip

For interfaces:

interface Ethernet 1
mpls ip

If authentication is not being used for the LDP sessions using a FIPS-approved message authentication code algorithm, this is a finding.

Check Content Reference

M

Target Key

5513