STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces.

DISA Rule

SV-256042r882468_rule

Vulnerability Number

V-256042

Group Title

SRG-NET-000364-RTR-000111

Rule Version

ARST-RT-000630

Severity

CAT III

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Disable LLDPs on all external interfaces.

LEAF-1A(config)#int ethernet 3
LEAF-1A(config-if-Et3)#no lldp transmit
LEAF-1A(config-if-Et3)#no lldp receive

Disable LLDP globally.

LEAF-1A(config)#no lldp run

Check Contents

This requirement is not applicable for the DODIN backbone.

Review all Arista router configurations to ensure LLDPs are not included in the global configuration or LLDPs are not included for each active external interface. Examples of LLDPs are Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), and Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED).

Disable LLDP on external interface.

int ethernet 3
no lldp transmit
no lldp receive

On Arista multi-layer routers, the LLDP can be disabled globally.

no lldp run

If LLDPs are configured globally or on any external interface, this is a finding.

Vulnerability Number

V-256042

Documentable

False

Rule Version

ARST-RT-000630

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Review all Arista router configurations to ensure LLDPs are not included in the global configuration or LLDPs are not included for each active external interface. Examples of LLDPs are Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), and Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED).

Disable LLDP on external interface.

int ethernet 3
no lldp transmit
no lldp receive

On Arista multi-layer routers, the LLDP can be disabled globally.

no lldp run

If LLDPs are configured globally or on any external interface, this is a finding.

Check Content Reference

M

Target Key

5513