Detections
Analytics

ARST-L2-000190 - The Arista MLS layer 2 switch must have the default VLAN pruned from all trunk ports that do not require it.

Information

The default VLAN (i.e., VLAN 1) is a special VLAN used for control plane traffic such as Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP). VLAN 1 is enabled on all trunks and ports by default. With larger campus networks, care needs to be taken about the diameter of the STP domain for the default VLAN. Instability in one part of the network could affect the default VLAN, thereby influencing control-plane stability and therefore STP stability for all other VLANs.

Solution

Best practice for VLAN-based networks is to configure Arista MLS switch to prune unnecessary trunk links from gaining access to the default VLAN and ensure frames belonging to the default VLAN do not traverse trunks not requiring frames from the VLAN.

Step 1: Configure the Arista MLS switch to ensure VLAN1 is pruned from all trunk and access ports that do not require it by using the following commands:

switch(config)#vlan 1
switch(config-vlan-1)#show active
switch(config-vlan-1)#sh act
vlan
 !! STIG suspend vlan 1 #state suspend vlan 1
switch(config-vlan-1)#exit

Step 2: Configure the Arista MLS switch to allow VLAN trunking except default VLAN 1 and configure Ethernet port 1 to change the native VLAN to 1000.

switch(config)#interface e10
switch(config-eth1o)#switchport trunk native vlan 1000
switch(config-eth1)#switchport trunk allowed vlan except 1

Step 3: Alternatively, the Arista MLS switch can use trunk groups to determine which trunks service which VLANs:

switch(config)#vlan 1
switch(config-vlan-1)#trunk group DO_NOT_USE
switch(config-vlan-1)#sh act
vlan
 !! STIG suspend vlan 1 #state suspend vlan 1
 trunk group DO_NOT_USE
hss474.10:51:12(config-vlan-1)#

Step 4: On Arista MLS switch, ensure any unnecessary trunk links have not gained access to default VLAN 1; this can be verified with the command 'show vlan brief':

switch(config)#sh vlan brief
VLAN Name Status Ports
----- -------------------------------- --------- -------------------------------
1 default
8 VLAN0008 active Cpu
25 VLAN0025 active Cpu
100 VLAN0100 active Cpu
1000 VLAN1000 active Eth1, Eth15, Eth16, Eth17
4090 VLAN4090 active Eth2, Eth20, Eth32

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y23M02_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-255982r882288_rule, STIG-ID|ARST-L2-000190, Vuln-ID|V-255982

Plugin: Arista

Control ID: 5a0a4481531acfed5cbbea4135bd9b8ad97818574180014ec0f133bf2d59462b