STIGQter: STIG Summary: Arista MLS DCS-7000 Series RTR Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The Arista Multilayer Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.

DISA Rule

SV-75351r1_rule

Vulnerability Number

V-60893

Group Title

SRG-NET-000019-RTR-000005

Rule Version

AMLS-L3-000130

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the appropriate boundaries to contain packets addressed within the administratively scoped zone. Defined multicast addresses are FFx4::/16, FFx5::/16, FFx8::/16, and 239.255.0.0/16.

To create a PIM Boundary, create an access list by entering:

ip access-list [name]
[ip access list permit/deny statement]
exit

Then apply the boundary filter based on the accesslist to the PIM-enabled interface:

int ethernet [X]
ip multicast boundary [name-of-ACL]

Check Contents

Review the multicast topology diagram to determine if there are any documented Admin-Local (FFx4::/16), Site-Local (FFx5::/16), or Organization-Local (FFx8::/16) multicast boundaries for IPv6 traffic or any Local-Scope (239.255.0.0/16) boundaries for IPv4 traffic.

Verify the appropriate boundaries are configured on the applicable multicast-enabled interfaces via an "ip multicast boundary" statement in the interface configuration.

If the appropriate boundaries are not configured on applicable multicast-enabled interfaces, this is a finding.

Vulnerability Number

V-60893

Documentable

False

Rule Version

AMLS-L3-000130

Severity Override Guidance

Review the multicast topology diagram to determine if there are any documented Admin-Local (FFx4::/16), Site-Local (FFx5::/16), or Organization-Local (FFx8::/16) multicast boundaries for IPv6 traffic or any Local-Scope (239.255.0.0/16) boundaries for IPv4 traffic.

Verify the appropriate boundaries are configured on the applicable multicast-enabled interfaces via an "ip multicast boundary" statement in the interface configuration.

If the appropriate boundaries are not configured on applicable multicast-enabled interfaces, this is a finding.

Check Content Reference

M

Target Key

2823

Comments