STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista multicast Designated Router (DR) must be configured to increase the shortest-path tree (SPT) threshold or set it to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.

DISA Rule

SV-256038r945856_rule

Vulnerability Number

V-256038

Group Title

SRG-NET-000362-RTR-000123

Rule Version

ARST-RT-000590

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the Arista multicast router to increase the SPT threshold or set it to infinity to minimalize (S, G) state within the multicast topology where ASM is deployed.

LEAF-1A(config)#router pim sparse-mode
LEAF-1A(config-router-pim-sparse)#ipv4
LEAF-1A(config-router-pim-sparse-ipv4)#spt threshold infinity

Check Contents

Review the Arista multicast last-hop router configuration to verify the SPT routerover threshold is increased (default is "0") or set to infinity (never router over).

router pim sparse-mode
ipv4
spt threshold infinity

If any Arista multicast router is not configured to increase the SPT threshold or set to infinity to minimalize (S, G) state, this is a finding.

Vulnerability Number

V-256038

Documentable

False

Rule Version

ARST-RT-000590

Severity Override Guidance

Review the Arista multicast last-hop router configuration to verify the SPT routerover threshold is increased (default is "0") or set to infinity (never router over).

router pim sparse-mode
ipv4
spt threshold infinity

If any Arista multicast router is not configured to increase the SPT threshold or set to infinity to minimalize (S, G) state, this is a finding.

Check Content Reference

M

Target Key

5513