STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The PE router providing MPLS Virtual Private Wire Service (VPWS) must be configured to have the appropriate virtual circuit identification (VC ID) for each attachment circuit.

DISA Rule

SV-256055r991794_rule

Vulnerability Number

V-256055

Group Title

SRG-NET-000512-RTR-000008

Rule Version

ARST-RT-000760

Severity

CAT I

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Assign globally unique VC IDs for each virtual circuit and configure the attachment circuits with the appropriate VC ID.

Configure the same VC ID on both ends of the VC.

patch panel
patch port
connector 1 interface Ethernet2
connector 2 pseudowire bgp vpws evi-1 pseudowire pw1
patch subintf
connector 1 interface Ethernet3.1
connector 2 pseudowire bgp vpws evi-1 pseudowire pw2

router bgp 65000
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 send-community extended
neighbor 10.0.0.1 maximum-routes 12000
!
vpws evi-1
rd 10.2.2.2:2
route-target import export evpn 0.0.0.0:1
mpls control-word
!
pseudowire pw1
evpn vpws id local 2001 remote 1001
!
pseudowire pw2
evpn vpws id local 2002 remote 1002
!
address-family evpn
neighbor default encapsulation mpls next-hop-self source-interface Loopback0
neighbor 10.0.0.1 activate

VLAN mode example:

interface Ethernet3
no routerport
!
interface Ethernet3.1
encapsulation dot1q vlan 1

Flexible Encapsulation example:

interface Ethernet3
no routerport
!
interface Ethernet3.1
encapsulation vlan
client dot1q 11 network client

Check Contents

Review the ingress and egress PE router configuration for each virtual circuit that has been provisioned.

Verify the correct and unique VCID has been configured for the appropriate attachment circuit.

Run the command sh run | section patch
patch panel
patch port
connector 1 interface Ethernet2
connector 2 pseudowire bgp vpws evi-1 pseudowire pw1
patch subintf
connector 1 interface Ethernet3.1
connector 2 pseudowire bgp vpws evi-1 pseudowire pw2

Run the command sh run | section router bgp
router bgp 65000
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 send-community extended
neighbor 10.0.0.1 maximum-routes 12000
!
vpws evi-1
rd 10.2.2.2:2
route-target import export evpn 0.0.0.0:1
mpls control-word
!
pseudowire pw1
evpn vpws id local 2001 remote 1001
!
pseudowire pw2
evpn vpws id local 2002 remote 1002
!
address-family evpn
neighbor default encapsulation mpls next-hop-self source-interface Loopback0
neighbor 10.0.0.1 activate

If the correct VC ID has not been configured on both routers, this is a finding.

Vulnerability Number

V-256055

Documentable

False

Rule Version

ARST-RT-000760

Severity Override Guidance

Review the ingress and egress PE router configuration for each virtual circuit that has been provisioned.

Verify the correct and unique VCID has been configured for the appropriate attachment circuit.

Run the command sh run | section patch
patch panel
patch port
connector 1 interface Ethernet2
connector 2 pseudowire bgp vpws evi-1 pseudowire pw1
patch subintf
connector 1 interface Ethernet3.1
connector 2 pseudowire bgp vpws evi-1 pseudowire pw2

Run the command sh run | section router bgp
router bgp 65000
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 send-community extended
neighbor 10.0.0.1 maximum-routes 12000
!
vpws evi-1
rd 10.2.2.2:2
route-target import export evpn 0.0.0.0:1
mpls control-word
!
pseudowire pw1
evpn vpws id local 2001 remote 1001
!
pseudowire pw2
evpn vpws id local 2002 remote 1002
!
address-family evpn
neighbor default encapsulation mpls next-hop-self source-interface Loopback0
neighbor 10.0.0.1 activate

If the correct VC ID has not been configured on both routers, this is a finding.

Check Content Reference

M

Target Key

5513