STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The PE router must be configured to have each VRF with the appropriate Route Distinguisher (RD).

DISA Rule

SV-256054r991793_rule

Vulnerability Number

V-256054

Group Title

SRG-NET-000512-RTR-000007

Rule Version

ARST-RT-000750

Severity

CAT II

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Configure the correct RD for each VRF.

Configure the correct Route Distinguisher.

PE11(config)#router bgp 65000
PE11(config-router-bgp)#vrf PROD
PE11(config-router-bgp-vrf-PROD)#rd 200:200

Check Contents

Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM.

Review all VRFs configured on CE-facing interfaces and verify the proper RD has been configured for each.

To verify the proper Route Distinguisher has been configured, execute the command "sh run sec router bgp".

router bgp 65000
vrf PROD
rd 200:200

If the wrong RD has been configured for any VRF, this is a finding.

Vulnerability Number

V-256054

Documentable

False

Rule Version

ARST-RT-000750

Severity Override Guidance

Review the RDs that have been assigned for each VRF according to the plan provided by the ISSM.

Review all VRFs configured on CE-facing interfaces and verify the proper RD has been configured for each.

To verify the proper Route Distinguisher has been configured, execute the command "sh run sec router bgp".

router bgp 65000
vrf PROD
rd 200:200

If the wrong RD has been configured for any VRF, this is a finding.

Check Content Reference

M

Target Key

5513