STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista router must be configured to have gratuitous ARP disabled on all external interfaces.

DISA Rule

SV-256030r882432_rule

Vulnerability Number

V-256030

Group Title

SRG-NET-000362-RTR-000111

Rule Version

ARST-RT-000510

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable gratuitous ARP on all external interfaces.

Disable

interface Ethernet 2
no arp gratuitous accept

Check Contents

Review the configuration to determine if gratuitous ARP is disabled on all external interfaces.

By default, Arista router interfaces reject gratuitous ARP request packets. To verify the gratuitous ARP is disabled, execute the command "sh run int ethernet YY".

These commands enable/disable gratuitous ARP packet acceptance on.

Enable

interface Ethernet 2
arp gratuitous accept

Disable

interface Ethernet 2
no arp gratuitous accept

If gratuitous ARP is enabled on any external interface, this is a finding.

Vulnerability Number

V-256030

Documentable

False

Rule Version

ARST-RT-000510

Severity Override Guidance

Review the configuration to determine if gratuitous ARP is disabled on all external interfaces.

By default, Arista router interfaces reject gratuitous ARP request packets. To verify the gratuitous ARP is disabled, execute the command "sh run int ethernet YY".

These commands enable/disable gratuitous ARP packet acceptance on.

Enable

interface Ethernet 2
arp gratuitous accept

Disable

interface Ethernet 2
no arp gratuitous accept

If gratuitous ARP is enabled on any external interface, this is a finding.

Check Content Reference

M

Target Key

5513