STIGQter: STIG Summary: Arista MLS DCS-7000 Series L2S Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 22 Apr 2016:

The Arista Multilayer Switch must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

DISA Rule

SV-75277r1_rule

Vulnerability Number

V-60821

Group Title

SRG-NET-000019

Rule Version

AMLS-L2-000110

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure an Access Control List to control information flow between connected networks.
Configuration Example
configure
mac access-list STIG
permit [src mac] [src mask] [dst mac] [dst mask]/[any] [protocol]
exit

Check Contents

Verify the use of MAC Access Control Lists to prevent unintended information flow between network segments.

For network boundary interfaces, verify the use of an access control list by entering "show mac access-list summary" to validate the use of an access control list on the interface.

Verify the access control list restricts network traffic as intended by entering "show mac access-list [name]" and substituting the name of the access control list for the bracketed variable.

If there is no access control list configured, or if the access control list does not prevent unintended flow of information between network segments, this is a finding.

Vulnerability Number

V-60821

Documentable

False

Rule Version

AMLS-L2-000110

Severity Override Guidance

Verify the use of MAC Access Control Lists to prevent unintended information flow between network segments.

For network boundary interfaces, verify the use of an access control list by entering "show mac access-list summary" to validate the use of an access control list on the interface.

Verify the access control list restricts network traffic as intended by entering "show mac access-list [name]" and substituting the name of the access control list for the bracketed variable.

If there is no access control list configured, or if the access control list does not prevent unintended flow of information between network segments, this is a finding.

Check Content Reference

M

Target Key

2821

Comments