ARST-L2-000200 - The Arista MLS layer 2 switch must not use the default VLAN for management traffic.

Information

Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)-all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.

Solution

Step 1: Configure the Arista MLS switch for a VRF instance for Management Network access by using the following commands:

switch(config)#vrf instance Management_Network
switch(config-vrf-Management_Network)#exit

Step 2: Configure the Ethernet port for VRF Management_Network and IP address for the management network traffic:

switch(config-if-Et12)#vrf Management_Network
switch(config-if-Et12)#ip address 10.10.40.254/30
switch(config-if-Et12)#exit

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y23M02_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-255983r882291_rule, STIG-ID|ARST-L2-000200, Vuln-ID|V-255983

Plugin: Arista

Control ID: 2e10bf9028b7b73b130d3436042199146cdb92e374e646973df9940eb685d025