STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The PE router must be configured to ignore or block all packets with any IP options.

DISA Rule

SV-256061r945860_rule

Vulnerability Number

V-256061

Group Title

SRG-NET-000205-RTR-000016

Rule Version

ARST-RT-000840

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure the PE router to block packets with IP options with the following commands:

router#config
router(config)# ip access-list IP_Option_ACL
10 deny ip any any ip-length gt 5
!
router(config)#interface Ethernet25
ip access-group IP_Option_ACL in
!

Check Contents

Verify the PE router is configured to block all packets with any IP options with the following command:

router#show run | section IP_Option_ACL
IP Access List IP_Option_ACL
10 deny ip any any ip-length gt 5
20 deny any log
!
interface Ethernet25
description STIG_IP_Option_ACL
ip access-group IP_Option_ACL in
!

If the perimeter router is not configured to block packets with IP options, this is a finding.

Vulnerability Number

V-256061

Documentable

False

Rule Version

ARST-RT-000840

Severity Override Guidance

Verify the PE router is configured to block all packets with any IP options with the following command:

router#show run | section IP_Option_ACL
IP Access List IP_Option_ACL
10 deny ip any any ip-length gt 5
20 deny any log
!
interface Ethernet25
description STIG_IP_Option_ACL
ip access-group IP_Option_ACL in
!

If the perimeter router is not configured to block packets with IP options, this is a finding.

Check Content Reference

M

Target Key

5513