STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista BGP router must be configured to use its loopback address as the source address for iBGP peering sessions.

DISA Rule

SV-256048r991789_rule

Vulnerability Number

V-256048

Group Title

SRG-NET-000512-RTR-000001

Rule Version

ARST-RT-000690

Severity

CAT III

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Ensure the Arista router's loopback address is used as the source address when originating traffic.

Step 1: Configure the Loopback interface.

LEAF-1A(config)#interface Loopback0
LEAF-1A(config-if-Lo0)#ip address 10.1.1.1/32

Step 2: Configure the loopback interface as source for all iBGP sessions.

router bgp 65001
LEAF-1A(config-router-bgp)#
LEAF-1A(config-router-bgp)#neighbor Peer_Leaf peer group
LEAF-1A(config-router-bgp)#Peer_Leaf remote-as 65001
LEAF-1A(config-router-bgp)#Peer_Leaf update-source Loopback0
LEAF-1A(config-router-bgp)#10.2.2.2 peer group Peer_Leaf

Check Contents

Review the Arista router configuration to verify a loopback address has been configured.

Verify a loopback interface is used as the source address for all iBGP sessions.

Step 1: To verify the Loopback interface is defined, execute the command "sh run int loopback YY".

interface loopback 0
ip address 10.1.1.1/32

Step 2: To verify a loopback interface is used as the source address for all iBGP sessions, execute the command "sh run sec router bgp".

router bgp 65001
router-id 10.1.1.1
neighbor Peer_Leaf peer group
neighbor Peer_Leaf remote-as 65001
neighbor Peer_Leaf update-source Loopback0
neighbor 10.2.2.2 peer group Peer_Leaf

If the Arista router does not use its loopback address as the source address for all iBGP sessions, this is a finding.

Vulnerability Number

V-256048

Documentable

False

Rule Version

ARST-RT-000690

Severity Override Guidance

Review the Arista router configuration to verify a loopback address has been configured.

Verify a loopback interface is used as the source address for all iBGP sessions.

Step 1: To verify the Loopback interface is defined, execute the command "sh run int loopback YY".

interface loopback 0
ip address 10.1.1.1/32

Step 2: To verify a loopback interface is used as the source address for all iBGP sessions, execute the command "sh run sec router bgp".

router bgp 65001
router-id 10.1.1.1
neighbor Peer_Leaf peer group
neighbor Peer_Leaf remote-as 65001
neighbor Peer_Leaf update-source Loopback0
neighbor 10.2.2.2 peer group Peer_Leaf

If the Arista router does not use its loopback address as the source address for all iBGP sessions, this is a finding.

Check Content Reference

M

Target Key

5513