Detections
Analytics
ARST-L2-000200 - The Arista MLS layer 2 switch must not use the default VLAN for management traffic.
Information
Switches use the default VLAN (i.e., VLAN 1) for in-band management and to communicate with directly connected switches using Spanning-Tree Protocol (STP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and Port Aggregation Protocol (PAgP)-all untagged traffic. As a consequence, the default VLAN may unwisely span the entire network if not appropriately pruned. If its scope is large enough, the risk of compromise can increase significantly.Solution
Step 1: Configure the Arista MLS switch for a VRF instance for Management Network access by using the following commands:switch(config)#vrf instance Management_Network
switch(config-vrf-Management_Network)#exit
Step 2: Configure the Ethernet port for VRF Management_Network and IP address for the management network traffic:
switch(config-if-Et12)#vrf Management_Network
switch(config-if-Et12)#ip address 10.10.40.254/30
switch(config-if-Et12)#exit
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y24M07_STIG.zip
Item Details
Audit Name: DISA STIG Arista MLS EOS 4.2x L2S v2r1
Category: CONTINGENCY PLANNING
References: 800-53|CP-8, CAT|II, CCI|CCI-004931, Rule-ID|SV-255983r991777_rule, STIG-ID|ARST-L2-000200, Vuln-ID|V-255983
Plugin: Arista
Control ID: b46cffaaa46230308990e807845155281e350cd5ff1a205f5a94f338527dca40