STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.

DISA Rule

SV-256057r882513_rule

Vulnerability Number

V-256057

Group Title

SRG-NET-000512-RTR-000012

Rule Version

ARST-RT-000780

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN backbone.

Configure the Arista router to advertise a hop limit of at least 32 in Router Advertisement messages.

LEAF-1A(config-if-Et3)#interface ethernet 3
LEAF-1A(config-if-Et3)#ipv6 nd ra hop-limit 32

Check Contents

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to determine if the hop limit has been configured for Router Advertisement messages. Execute the command "sh run | section hop-limit".

interface Ethernet3
ipv6 nd ra hop-limit 32

If the router has been configured and has not been set to at least 32, this is a finding.

Vulnerability Number

V-256057

Documentable

False

Rule Version

ARST-RT-000780

Severity Override Guidance

This requirement is not applicable for the DODIN backbone.

Review the Arista router configuration to determine if the hop limit has been configured for Router Advertisement messages. Execute the command "sh run | section hop-limit".

interface Ethernet3
ipv6 nd ra hop-limit 32

If the router has been configured and has not been set to at least 32, this is a finding.

Check Content Reference

M

Target Key

5513