ARST-RT-000010 - The Arista router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-255987r882303_rule

STIG-ID|ARST-RT-000010

Vuln-ID|V-255987

ARST-RT-000020 - The Arista BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Rule-ID|SV-255988r882306_rule

STIG-ID|ARST-RT-000020

Vuln-ID|V-255988

ARST-RT-000030 - The Arista BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Rule-ID|SV-255989r882309_rule

STIG-ID|ARST-RT-000030

Vuln-ID|V-255989

ARST-RT-000040 - The Arista BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

Rule-ID|SV-255990r882312_rule

STIG-ID|ARST-RT-000040

Vuln-ID|V-255990

ARST-RT-000050 - The Arista BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

Rule-ID|SV-255991r882315_rule

STIG-ID|ARST-RT-000050

Vuln-ID|V-255991

ARST-RT-000060 - The Arista BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

800-53|AC-4(8)

CAT|III

CCI|CCI-000032

Rule-ID|SV-255992r945854_rule

STIG-ID|ARST-RT-000060

Vuln-ID|V-255992

ARST-RT-000070 - The Arista Multicast Source Discovery Protocol (MSDP) router must be configured to filter received source-active multicast advertisements for any undesirable multicast groups and sources.

Rule-ID|SV-255993r882321_rule

STIG-ID|ARST-RT-000070

Vuln-ID|V-255993

ARST-RT-000080 - The Arista Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

Rule-ID|SV-255994r882324_rule

STIG-ID|ARST-RT-000080

Vuln-ID|V-255994

ARST-RT-000090 - The Arista MSDP router must be configured to limit the amount of source-active messages it accepts on per-peer basis.

Rule-ID|SV-255995r882327_rule

STIG-ID|ARST-RT-000090

Vuln-ID|V-255995

ARST-RT-000100 - The Arista BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Rule-ID|SV-255996r945855_rule

STIG-ID|ARST-RT-000100

Vuln-ID|V-255996

ARST-RT-000110 - The Arista perimeter router must be configured to enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

CCI|CCI-001414

Rule-ID|SV-255997r882333_rule

STIG-ID|ARST-RT-000110

Vuln-ID|V-255997

ARST-RT-000120 - The Arista multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

Rule-ID|SV-255998r882336_rule

STIG-ID|ARST-RT-000120

Vuln-ID|V-255998

ARST-RT-000130 - The Arista multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

Rule-ID|SV-255999r882339_rule

STIG-ID|ARST-RT-000130

Vuln-ID|V-255999

ARST-RT-000140 - The Arista multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.

Rule-ID|SV-256000r882342_rule

STIG-ID|ARST-RT-000140

Vuln-ID|V-256000

ARST-RT-000150 - The Arista router must be configured to have all inactive interfaces disabled.

Rule-ID|SV-256001r882345_rule

STIG-ID|ARST-RT-000150

Vuln-ID|V-256001

ARST-RT-000160 - The Arista perimeter router must be configured to protect an enclave connected to an alternate gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

CAT|I

Rule-ID|SV-256002r882348_rule

STIG-ID|ARST-RT-000160

Vuln-ID|V-256002

ARST-RT-000170 - The Arista perimeter router must be configured to not be a Border Gateway Protocol (BGP) peer to an alternate gateway service provider.

Rule-ID|SV-256003r882351_rule

STIG-ID|ARST-RT-000170

Vuln-ID|V-256003

ARST-RT-000180 - The Arista perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into BGP or an IGP peering with the NIPRNet or to other autonomous systems.

Rule-ID|SV-256004r882354_rule

STIG-ID|ARST-RT-000180

Vuln-ID|V-256004

ARST-RT-000190 - The out-of-band management (OOBM) Arista gateway router must be configured to have separate IGP instances for the managed network and management network.

Rule-ID|SV-256005r882357_rule

STIG-ID|ARST-RT-000190

Vuln-ID|V-256005

ARST-RT-000200 - The out-of-band management (OOBM) Arista gateway router must be configured to not redistribute routes between the management network routing domain and the managed network routing domain.

Rule-ID|SV-256006r882360_rule

STIG-ID|ARST-RT-000200

Vuln-ID|V-256006

ARST-RT-000210 - The multicast Rendezvous Point (RP) Arista router must be configured to filter Protocol Independent Multicast (PIM) Register and Join messages received from the Designated Router (DR) for any undesirable multicast groups and sources.

Rule-ID|SV-256007r882363_rule

STIG-ID|ARST-RT-000210

Vuln-ID|V-256007

ARST-RT-000230 - The Arista router must be configured to produce audit records containing information to establish where the events occurred.

800-53|AU-3

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

Rule-ID|SV-256008r882366_rule

STIG-ID|ARST-RT-000230

Vuln-ID|V-256008

ARST-RT-000260 - The Arista router must be configured to have all non-essential capabilities disabled.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-256009r882369_rule

STIG-ID|ARST-RT-000260

Vuln-ID|V-256009

ARST-RT-000280 - The Arista router must be configured to authenticate all routing protocol messages using NIST-validated FIPS 198-1 message authentication code algorithm.

800-53|AC-4(17)

800-53|IA-7

CCI|CCI-000803

CCI|CCI-002205

Rule-ID|SV-256010r882372_rule

STIG-ID|ARST-RT-000280

Vuln-ID|V-256010

ARST-RT-000290 - The MPLS router with RSVP-TE enabled must be configured with message pacing or refresh reduction to adjust maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core routers.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-256011r882375_rule

STIG-ID|ARST-RT-000290

Vuln-ID|V-256011

ARST-RT-000300 - The PE router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

Rule-ID|SV-256012r882378_rule

STIG-ID|ARST-RT-000300

Vuln-ID|V-256012

ARST-RT-000310 - The PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS DODIN Technical Profile.

Rule-ID|SV-256013r882381_rule

STIG-ID|ARST-RT-000310

Vuln-ID|V-256013

ARST-RT-000320 - The PE router must be configured to enforce a Quality-of-Service (QoS) policy in accordance with the QoS GIG Technical Profile.

Rule-ID|SV-256014r882384_rule

STIG-ID|ARST-RT-000320

Vuln-ID|V-256014

ARST-RT-000330 - The Arista perimeter router must be configured to deny network traffic by default and allow network traffic by exception.

800-53|SC-7(5)

CCI|CCI-001109

Rule-ID|SV-256015r882387_rule

STIG-ID|ARST-RT-000330

Vuln-ID|V-256015

ARST-RT-000340 - The Arista router must be configured to restrict traffic destined to itself.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-256016r882390_rule

STIG-ID|ARST-RT-000340

Vuln-ID|V-256016

ARST-RT-000350 - The Arista router must be configured to drop all fragmented Internet Control Message Protocol (ICMP) packets destined to itself.

Rule-ID|SV-256017r882393_rule

STIG-ID|ARST-RT-000350

Vuln-ID|V-256017

ARST-RT-000370 - The Arista perimeter router must be configured to filter ingress traffic at the external interface on an inbound direction.

Rule-ID|SV-256018r882396_rule

STIG-ID|ARST-RT-000370

Vuln-ID|V-256018

ARST-RT-000380 - The Arista perimeter router must be configured to filter egress traffic at the internal interface on an inbound direction.

Rule-ID|SV-256019r882399_rule

STIG-ID|ARST-RT-000380

Vuln-ID|V-256019

ARST-RT-000390 - The Arista BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Rule-ID|SV-256020r882402_rule

STIG-ID|ARST-RT-000390

Vuln-ID|V-256020

ARST-RT-000400 - The Arista router must be configured to block any traffic that is destined to IP core infrastructure.

Rule-ID|SV-256021r882405_rule

STIG-ID|ARST-RT-000400

Vuln-ID|V-256021

ARST-RT-000410 - The Arista router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all CE-facing interfaces.

Rule-ID|SV-256022r882408_rule

STIG-ID|ARST-RT-000410

Vuln-ID|V-256022

ARST-RT-000420 - The out-of-band management (OOBM) Arista gateway router must be configured to forward only authorized management traffic to the Network Operations Center (NOC).

CCI|CCI-004931

Rule-ID|SV-256023r991786_rule

STIG-ID|ARST-RT-000420

Vuln-ID|V-256023

ARST-RT-000430 - The out-of-band management (OOBM) Arista gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the NOC.

Rule-ID|SV-256024r991787_rule

STIG-ID|ARST-RT-000430

Vuln-ID|V-256024

ARST-RT-000440 - The Arista router must be configured to only permit management traffic that ingresses and egresses the out-of-band management (OOBM) interface.

Rule-ID|SV-256025r991788_rule

STIG-ID|ARST-RT-000440

Vuln-ID|V-256025

ARST-RT-000450 - The Arista perimeter router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-256026r945858_rule

STIG-ID|ARST-RT-000450

Vuln-ID|V-256026

ARST-RT-000470 - The Arista BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.

Rule-ID|SV-256027r945862_rule

STIG-ID|ARST-RT-000470

Vuln-ID|V-256027

ARST-RT-000480 - The PE router providing MPLS Layer 2 Virtual Private Network (L2VPN) services must be configured to authenticate targeted Label Distribution Protocol (LDP) sessions used to exchange virtual circuit (VC) information using a FIPS-approved message authentication code algorithm.

800-53|IA-3

CCI|CCI-001958

Rule-ID|SV-256028r882426_rule

STIG-ID|ARST-RT-000480

Vuln-ID|V-256028

ARST-RT-000490 - The Arista router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.

Detections

Analytics

DISA Arista MLS EOS 4.X Router STIG v2r2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous