STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The PE router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).

DISA Rule

SV-256053r991792_rule

Vulnerability Number

V-256053

Group Title

SRG-NET-000512-RTR-000006

Rule Version

ARST-RT-000740

Severity

CAT I

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Configure all J-PE Arista routers to have the correct VRF defined with the appropriate RT.

Configure the route-target's for import and export.

PE11(config)#router bgp 65000
PE11(config-router-bgp)#vrf PROD
PE11(config-router-bgp-vrf-PROD)#rd 200:200
PE11(config-router-bgp-vrf-PROD)#route-target import vpn-ipv4 200:200
PE11(config-router-bgp-vrf-PROD)#route-target export vpn-ipv4 200:200

Check Contents

Verify the correct RT is configured for each VRF.

Review the design plan for MPLS/L3VPN and VRF-lite to determine what RTs have been assigned for each VRF.

Review the route-target import, route-target, or route-target export statements under each configured VRF and verify the correct RTs have been defined for each VRF.

To verify the correct RTs have been defined for each VRF on a PE router, execute the command "sh run sec router bgp".

router bgp 65000
vrf PROD
rd 200:200
route-target import vpn-ipv4 200:200
route-target export vpn-ipv4 200:200

Note: Import and export route-maps are normally used when finer granularity is required.

If VRFs are configured with the wrong RT, this is a finding.

Vulnerability Number

V-256053

Documentable

False

Rule Version

ARST-RT-000740

Severity Override Guidance

Verify the correct RT is configured for each VRF.

Review the design plan for MPLS/L3VPN and VRF-lite to determine what RTs have been assigned for each VRF.

Review the route-target import, route-target, or route-target export statements under each configured VRF and verify the correct RTs have been defined for each VRF.

To verify the correct RTs have been defined for each VRF on a PE router, execute the command "sh run sec router bgp".

router bgp 65000
vrf PROD
rd 200:200
route-target import vpn-ipv4 200:200
route-target export vpn-ipv4 200:200

Note: Import and export route-maps are normally used when finer granularity is required.

If VRFs are configured with the wrong RT, this is a finding.

Check Content Reference

M

Target Key

5513