STIGQter: STIG Summary: Arista MLS DCS-7000 Series RTR Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The Arista Multilayer Switch must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.

DISA Rule

SV-75369r2_rule

Vulnerability Number

V-60911

Group Title

SRG-NET-000018-RTR-000001

Rule Version

AMLS-L3-000210

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-002190 - The information system uses organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.

Weight

10

Fix Recommendation

Configure the router to enforce flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects as a basis for flow control decisions.

To enforce flow control using explicit security attributes, configure access control lists as per organization-defined requirements, to include statements such as:

ip access-list [Name}
deny [protocol] [source address] [source port] [destination address] [destination port] [dscp filter] [ttl filter]

Check Contents

If explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) are not used to enforce information flow control, this is a finding.

Review the configuration of any access control list on the switch to determine if explicit attributes are being utilized. The ACL must include explicit attributes such as ip addresses, port numbers, protocols, etc.

Note that the Arista MLS includes a deny-by-default statement that is not displayed in the CLI. This statement exists at the end of every ACL.

Vulnerability Number

V-60911

Documentable

False

Rule Version

AMLS-L3-000210

Severity Override Guidance

If explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) are not used to enforce information flow control, this is a finding.

Review the configuration of any access control list on the switch to determine if explicit attributes are being utilized. The ACL must include explicit attributes such as ip addresses, port numbers, protocols, etc.

Note that the Arista MLS includes a deny-by-default statement that is not displayed in the CLI. This statement exists at the end of every ACL.

Check Content Reference

M

Target Key

2823

Comments