STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.

DISA Rule

SV-256035r882447_rule

Vulnerability Number

V-256035

Group Title

SRG-NET-000362-RTR-000117

Rule Version

ARST-RT-000560

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure all eBGP Arista routers to use the maximum prefixes feature to protect against route table flooding and prefix deaggregation attacks.

Configure each BGP neighbor to control the number of prefixes.

router bgp NNN
neighbor x.1.12.1 remote-as YYY
neighbor x.1.12.1 maximum-routes 12000
neighbor x.1.12.1 maximum-accepted-routes 10000

Check Contents

Review the Arista router configuration to verify the number of received prefixes from each eBGP neighbor is controlled.

To verify in the BGP configuration that number of received prefixes from each eBGP neighbor is controlled, execute the command "sh rnu section router bgp".

router bgp NNN
neighbor x.1.12.1 remote-as YYY
neighbor x.1.12.1 maximum-routes 12000
neighbor x.1.12.1 maximum-accepted-routes 10000

If the Arista router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Vulnerability Number

V-256035

Documentable

False

Rule Version

ARST-RT-000560

Severity Override Guidance

Review the Arista router configuration to verify the number of received prefixes from each eBGP neighbor is controlled.

To verify in the BGP configuration that number of received prefixes from each eBGP neighbor is controlled, execute the command "sh rnu section router bgp".

router bgp NNN
neighbor x.1.12.1 remote-as YYY
neighbor x.1.12.1 maximum-routes 12000
neighbor x.1.12.1 maximum-accepted-routes 10000

If the Arista router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Check Content Reference

M

Target Key

5513