STIGQter: STIG Summary: Arista MLS DCS-7000 Series RTR Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The Arista Multilayer Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.

DISA Rule

SV-75381r2_rule

Vulnerability Number

V-60923

Group Title

SRG-NET-000362-RTR-000110

Rule Version

AMLS-L3-000270

Severity

CAT II

CCI(s)

• CCI-001095 - The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Implement a mechanism for traffic prioritization and bandwidth reservation. This mechanism must enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

Arista QoS implementations vary according to the underlying hardware platform. For a complete reference on how to configure QoS for the platform under evaluation, refer to the Arista configuration manual, Chapter 21.

Check Contents

Review the router configuration and interview the system administrator; verify that a mechanism for traffic prioritization and bandwidth reservation exists. This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

To review the configuration, execute a "show qos interfaces" command to see the qos configuration for all interfaces or "show qos interfaces [type] [number] to review the configuration for a specific interface.

QoS must be configured according to organizational policies.

If no such scheme exists or it is not configured, this is a finding.

Vulnerability Number

V-60923

Documentable

False

Rule Version

AMLS-L3-000270

Severity Override Guidance

Review the router configuration and interview the system administrator; verify that a mechanism for traffic prioritization and bandwidth reservation exists. This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commanders/Services/Agencies.

To review the configuration, execute a "show qos interfaces" command to see the qos configuration for all interfaces or "show qos interfaces [type] [number] to review the configuration for a specific interface.

QoS must be configured according to organizational policies.

If no such scheme exists or it is not configured, this is a finding.

Check Content Reference

M

Target Key

2823

Comments