AMLS-L3-000100 - The Arista Multilayer Switch must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

800-53|SC-3(2)

CAT|II

CCI|CCI-001414

Group-ID|V-60817

Rule-ID|SV-75273r1_rule

STIG-ID|AMLS-L3-000100

Vuln-ID|V-60817

AMLS-L3-000110 - The Arista Multilayer Switch must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

800-53|SC-7(11)

Group-ID|V-60889

Rule-ID|SV-75347r1_rule

STIG-ID|AMLS-L3-000110

Vuln-ID|V-60889

AMLS-L3-000120 - The Arista Multilayer Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled - PIM neighbor filter to interfaces that have PIM enabled.

Group-ID|V-60891

Rule-ID|SV-75349r1_rule

STIG-ID|AMLS-L3-000120

Vuln-ID|V-60891

AMLS-L3-000130 - The Arista Multilayer Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.

Group-ID|V-60893

Rule-ID|SV-75351r1_rule

STIG-ID|AMLS-L3-000130

Vuln-ID|V-60893

AMLS-L3-000140 - The Arista Multilayer Switch must be configured so inactive router interfaces are disabled.

800-53|SC-7(14)

Group-ID|V-60895

Rule-ID|SV-75353r1_rule

STIG-ID|AMLS-L3-000140

Vuln-ID|V-60895

AMLS-L3-000150 - The Arista Multilayer Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

800-53|SC-7(15)

Group-ID|V-60897

Rule-ID|SV-75355r1_rule

STIG-ID|AMLS-L3-000150

Vuln-ID|V-60897

AMLS-L3-000160 - If Border Gateway Protocol (BGP) is enabled on The Arista Multilayer Switch, The Arista Multilayer Switch must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.

800-53|SC-7(21)

Group-ID|V-60899

Rule-ID|SV-75357r1_rule

STIG-ID|AMLS-L3-000160

Vuln-ID|V-60899

AMLS-L3-000170 - The Arista Multilayer Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.

Group-ID|V-60903

Rule-ID|SV-75361r1_rule

STIG-ID|AMLS-L3-000170

Vuln-ID|V-60903

AMLS-L3-000180 - The Arista Multilayer Switch must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.

Group-ID|V-60905

Rule-ID|SV-75363r1_rule

STIG-ID|AMLS-L3-000180

Vuln-ID|V-60905

AMLS-L3-000190 - The Arista Multilayer Switch must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.

Group-ID|V-60907

Rule-ID|SV-75365r1_rule

STIG-ID|AMLS-L3-000190

Vuln-ID|V-60907

AMLS-L3-000200 - The Arista Multilayer Switch must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.

Group-ID|V-60909

Rule-ID|SV-75367r1_rule

STIG-ID|AMLS-L3-000200

Vuln-ID|V-60909

AMLS-L3-000210 - The Arista Multilayer Switch must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.

CCI|CCI-000366

CCI|CCI-002190

Group-ID|V-60911

Rule-ID|SV-75369r2_rule

STIG-ID|AMLS-L3-000210

Vuln-ID|V-60911

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - BGP

800-53|IA-3

CCI|CCI-002205

Group-ID|V-60913

Rule-ID|SV-75371r2_rule

STIG-ID|AMLS-L3-000220

Vuln-ID|V-60913

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - IS-IS auth mode

800-53|IA-3(1)

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - IS-IS md5 key

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - OSPF MD5 Key

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - OSPF message-digest

AMLS-L3-000230 - The Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.

CCI|CCI-001094

Group-ID|V-60915

Rule-ID|SV-75373r1_rule

STIG-ID|AMLS-L3-000230

Vuln-ID|V-60915

AMLS-L3-000240 - The Arista Multilayer Switch must be configured to disable non-essential capabilities.

CCI|CCI-000381

Group-ID|V-60917

Rule-ID|SV-75375r1_rule

STIG-ID|AMLS-L3-000240

Vuln-ID|V-60917

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ipv6 OSPF checks

CCI|CCI-000803

Group-ID|V-60919

Rule-ID|SV-75377r2_rule

STIG-ID|AMLS-L3-000250

Vuln-ID|V-60919

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ospf message-digest

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ospf message-digest-key

AMLS-L3-000260 - The Arista Multilayer Switch must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM) or are configured to meet RFC3682.

800-53|SC-5

CCI|CCI-002385

Group-ID|V-60921

Rule-ID|SV-75379r1_rule

STIG-ID|AMLS-L3-000260

Vuln-ID|V-60921

AMLS-L3-000270 - The Arista Multilayer Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks - DoS attacks.

800-53|SC-6

CCI|CCI-001095

Group-ID|V-60923

Rule-ID|SV-75381r2_rule

STIG-ID|AMLS-L3-000270

Vuln-ID|V-60923

AMLS-L3-000290 - The Arista Multilayer Switch must configure the maximum hop limit value to at least 32.

800-53|CM-6

CCI|CCI-001097

Group-ID|V-60927

Rule-ID|SV-75385r2_rule

STIG-ID|AMLS-L3-000290

Vuln-ID|V-60927

AMLS-L3-000300 - The Arista Multilayer Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.

CCI|CCI-002403

Group-ID|V-60929

Rule-ID|SV-75387r1_rule

STIG-ID|AMLS-L3-000300

Vuln-ID|V-60929

AMLS-L3-000320 - The Arista Multilayer Switch must not enable the RIP routing protocol.

Detections

Analytics

DISA STIG Arista MLS DCS-7000 Series RTR v1r3

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.6 Aug 19, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.5 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.4 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.3 Apr 25, 2022 Miscellaneous Metadata updated. References updated.
Revision 1.2 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Jun 17, 2021 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG Arista MLS DCS-7000 Series RTR v1r3 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Arista MLS DCS-7000 Series RTR v1r3