STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The MPLS router must be configured to have TTL propagation disabled.

DISA Rule

SV-256051r882495_rule

Vulnerability Number

V-256051

Group Title

SRG-NET-000512-RTR-000004

Rule Version

ARST-RT-000720

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure Arista LERs to disable TTL propagation.

Configure the router to disable the TTL propagation in MPLS core network.

router(config)#no mpls icmp ttl-exceeded tunneling

Check Contents

Review the Arista router configuration to verify TTL propagation is disabled.

Verify the router is configured to disable the TTL propagation.

no mpls icmp ttl-exceeded tunneling

If the Arista router is not configured to disable TTL propagation, this is a finding.

Vulnerability Number

V-256051

Documentable

False

Rule Version

ARST-RT-000720

Severity Override Guidance

Review the Arista router configuration to verify TTL propagation is disabled.

Verify the router is configured to disable the TTL propagation.

no mpls icmp ttl-exceeded tunneling

If the Arista router is not configured to disable TTL propagation, this is a finding.

Check Content Reference

M

Target Key

5513