STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista router must be configured to have IP directed broadcast disabled on all interfaces.

DISA Rule

SV-256031r884234_rule

Vulnerability Number

V-256031

Group Title

SRG-NET-000362-RTR-000112

Rule Version

ARST-RT-000520

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Disable IP directed broadcasts on all layer 3 interfaces.

LEAF-1A(config)#interface Ethernet 2
LEAF-1A(config-if-Et2)# ip address 10.1.12.1/24
LEAF-1A(config-if-Et2)# no ip directed-broadcast

Check Contents

Review the Arista router configuration to determine if IP directed broadcast is enabled.

By default, IP directed broadcast is disabled on Arista multi-layer router. To verify the IP directed broadcast is enabled, execute the command:

sh run int ethernet <YY>

interface Ethernet 2
ip address 10.1.12.1/24
no ip directed-broadcast

If IP directed broadcast is enabled on layer 3 interfaces, this is a finding.

Vulnerability Number

V-256031

Documentable

False

Rule Version

ARST-RT-000520

Severity Override Guidance

Review the Arista router configuration to determine if IP directed broadcast is enabled.

By default, IP directed broadcast is disabled on Arista multi-layer router. To verify the IP directed broadcast is enabled, execute the command:

sh run int ethernet <YY>

interface Ethernet 2
ip address 10.1.12.1/24
no ip directed-broadcast

If IP directed broadcast is enabled on layer 3 interfaces, this is a finding.

Check Content Reference

M

Target Key

5513