STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista perimeter router must be configured to block all outbound management traffic.

DISA Rule

SV-256044r945857_rule

Vulnerability Number

V-256044

Group Title

SRG-NET-000364-RTR-000113

Rule Version

ARST-RT-000650

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Configure the Arista perimeter router of the managed network with an ACL or filter on the egress interface to block all outbound management traffic.

Step 1: Configure the filter to block all outbound traffic destined to the management network.

LEAF-1A(config-if-Et3)#ip access-list FILTER_MANAGEMENT_SUBNET
LEAF-1A(config-acl-FILTER_MANAGEMENT_SUBNET)# deny ip any 172.20.1.0 0.0.0.255 log
LEAF-1A(config-acl-FILTER_MANAGEMENT_SUBNET)# permit ip any any

Step 2: Apply the filter egress on the interface.

LEAF-1A(config-acl-FILTER_MANAGEMENT_SUBNET)#interface ethernet 3
LEAF-1A(config-if-Et3)#ip access-group FILTER_MANAGEMENT_SUBNET out

Check Contents

This requirement is not applicable for the DODIN backbone.

The Arista perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.

Step 1: To verify the configuration is blocking all outbound traffic destined to management network, execute the command "sh ip access-list".

ip access-list FILTER_MANAGEMENT_SUBNET
deny ip any 172.20.1.0 0.0.0.255 log
permit ip any any

Step 2: To verify the filter is applied on egress interface, execute the command "sh run int ethernet YY".

interface ethernet 3
ip access-group FILTER_MANAGEMENT_SUBNET out

If management traffic is not blocked at the perimeter, this is a finding.

Vulnerability Number

V-256044

Documentable

False

Rule Version

ARST-RT-000650

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

The Arista perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.

Step 1: To verify the configuration is blocking all outbound traffic destined to management network, execute the command "sh ip access-list".

ip access-list FILTER_MANAGEMENT_SUBNET
deny ip any 172.20.1.0 0.0.0.255 log
permit ip any any

Step 2: To verify the filter is applied on egress interface, execute the command "sh run int ethernet YY".

interface ethernet 3
ip access-group FILTER_MANAGEMENT_SUBNET out

If management traffic is not blocked at the perimeter, this is a finding.

Check Content Reference

M

Target Key

5513