STIGQter: STIG Summary: Arista MLS DCS-7000 Series L2S Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 22 Apr 2016:

The Arista Multilayer Switch must re-authenticate 802.1X connected devices every hour.

DISA Rule

SV-75285r1_rule

Vulnerability Number

V-60829

Group Title

SRG-NET-000338

Rule Version

AMLS-L2-000150

Severity

CAT II

CCI(s)

• CCI-002039 - The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.

Weight

10

Fix Recommendation

Configure 802.1X on the switch, using the following mandatory parameters for all applicable interfaces. Replace the bracketed variable with the applicable value.

config
interface Ethernet[X]
switchport access vlan [Y]
dot1x pae authenticator
dot1x reauthentication
dot1x port-control auto
dot1x host-mode single-host
dot1x timeout quiet-period [value]
dot1x timeout reauth-period 3600
dot1x max-reauth-req [value]

For the global configuration, include the following command statements from the global configuration mode interface:

logging level DOT1X informational
aaa authentication dot1x default group radius
dot1x system-auth-control

Check Contents

This requirement only applies to devices required to employ 802.1X.

Verify the Arista Multilayer Switch re-authenticates 802.1X connected devices every hour. If the Arista Multilayer Switch does not re-authenticate 802.1X connected devices, this is a finding.

This can be viewed via the "show dot1x all" command. Under the interface configuration for the .1X connected port, the following statements must be present:

ReauthPeriod : 3600 seconds

If the device does not require re-authentication, or if the re-authentication period is longer than 60 minutes, this is a finding.

Vulnerability Number

V-60829

Documentable

False

Rule Version

AMLS-L2-000150

Severity Override Guidance

This requirement only applies to devices required to employ 802.1X.

Verify the Arista Multilayer Switch re-authenticates 802.1X connected devices every hour. If the Arista Multilayer Switch does not re-authenticate 802.1X connected devices, this is a finding.

This can be viewed via the "show dot1x all" command. Under the interface configuration for the .1X connected port, the following statements must be present:

ReauthPeriod : 3600 seconds

If the device does not require re-authentication, or if the re-authentication period is longer than 60 minutes, this is a finding.

Check Content Reference

M

Target Key

2821

Comments