AMLS-L3-000100 - The Arista Multilayer Switch must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.

800-53|AC-4

CAT|II

CCI|CCI-001414

Rule-ID|SV-217488r382735_rule

STIG-ID|AMLS-L3-000100

STIG-Legacy|SV-75273

STIG-Legacy|V-60817

Vuln-ID|V-217488

AMLS-L3-000110 - The Arista Multilayer Switch must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

Rule-ID|SV-217489r382735_rule

STIG-ID|AMLS-L3-000110

STIG-Legacy|SV-75347

STIG-Legacy|V-60889

Vuln-ID|V-217489

AMLS-L3-000120 - The Arista Multilayer Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled - PIM neighbor filter to interfaces that have PIM enabled.

Rule-ID|SV-217490r382735_rule

STIG-ID|AMLS-L3-000120

STIG-Legacy|SV-75349

STIG-Legacy|V-60891

Vuln-ID|V-217490

AMLS-L3-000130 - The Arista Multilayer Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.

Rule-ID|SV-217491r382735_rule

STIG-ID|AMLS-L3-000130

STIG-Legacy|SV-75351

STIG-Legacy|V-60893

Vuln-ID|V-217491

AMLS-L3-000140 - The Arista Multilayer Switch must be configured so inactive router interfaces are disabled.

Rule-ID|SV-217492r382735_rule

STIG-ID|AMLS-L3-000140

STIG-Legacy|SV-75353

STIG-Legacy|V-60895

Vuln-ID|V-217492

AMLS-L3-000150 - The Arista Multilayer Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.

Rule-ID|SV-217493r382735_rule

STIG-ID|AMLS-L3-000150

STIG-Legacy|SV-75355

STIG-Legacy|V-60897

Vuln-ID|V-217493

AMLS-L3-000160 - If Border Gateway Protocol (BGP) is enabled on The Arista Multilayer Switch, The Arista Multilayer Switch must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.

Rule-ID|SV-217494r382735_rule

STIG-ID|AMLS-L3-000160

STIG-Legacy|SV-75357

STIG-Legacy|V-60899

Vuln-ID|V-217494

AMLS-L3-000170 - The Arista Multilayer Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.

Rule-ID|SV-217495r382735_rule

STIG-ID|AMLS-L3-000170

STIG-Legacy|SV-75361

STIG-Legacy|V-60903

Vuln-ID|V-217495

AMLS-L3-000180 - The Arista Multilayer Switch must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.

Rule-ID|SV-217496r382735_rule

STIG-ID|AMLS-L3-000180

STIG-Legacy|SV-75363

STIG-Legacy|V-60905

Vuln-ID|V-217496

AMLS-L3-000190 - The Arista Multilayer Switch must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.

Rule-ID|SV-217497r382735_rule

STIG-ID|AMLS-L3-000190

STIG-Legacy|SV-75365

STIG-Legacy|V-60907

Vuln-ID|V-217497

AMLS-L3-000200 - The Arista Multilayer Switch must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.

Rule-ID|SV-217498r382735_rule

STIG-ID|AMLS-L3-000200

STIG-Legacy|SV-75367

STIG-Legacy|V-60909

Vuln-ID|V-217498

AMLS-L3-000210 - The Arista Multilayer Switch must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.

800-53|AC-4(1)

800-53|CM-6b.

CCI|CCI-000366

CCI|CCI-002190

Rule-ID|SV-220130r856154_rule

STIG-ID|AMLS-L3-000210

STIG-Legacy|SV-75369

STIG-Legacy|V-60911

Vuln-ID|V-220130

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - BGP

800-53|AC-4(17)

CCI|CCI-002205

Rule-ID|SV-217523r945861_rule

STIG-ID|AMLS-L3-000220

STIG-Legacy|SV-75371

STIG-Legacy|V-60913

Vuln-ID|V-217523

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - IS-IS auth mode

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - IS-IS md5 key

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - OSPF MD5 Key

AMLS-L3-000220 - The Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP - OSPF message-digest

AMLS-L3-000230 - The Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-217524r945858_rule

STIG-ID|AMLS-L3-000230

STIG-Legacy|SV-75373

STIG-Legacy|V-60915

Vuln-ID|V-217524

AMLS-L3-000240 - The Arista Multilayer Switch must be configured to disable non-essential capabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-217499r382903_rule

STIG-ID|AMLS-L3-000240

STIG-Legacy|SV-75375

STIG-Legacy|V-60917

Vuln-ID|V-217499

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ipv6 OSPF checks

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-217500r385516_rule

STIG-ID|AMLS-L3-000250

STIG-Legacy|SV-75377

STIG-Legacy|V-60919

Vuln-ID|V-217500

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ospf message-digest

AMLS-L3-000250 - The Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol - ospf message-digest-key

AMLS-L3-000260 - The Arista Multilayer Switch must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM) or are configured to meet RFC3682.

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-217525r856153_rule

STIG-ID|AMLS-L3-000260

STIG-Legacy|SV-75379

STIG-Legacy|V-60921

Vuln-ID|V-217525

AMLS-L3-000270 - The Arista Multilayer Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks - DoS attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-220131r539011_rule

STIG-ID|AMLS-L3-000270

STIG-Legacy|SV-75381

STIG-Legacy|V-60923

Vuln-ID|V-220131

AMLS-L3-000290 - The Arista Multilayer Switch must configure the maximum hop limit value to at least 32.

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-220133r539012_rule

STIG-ID|AMLS-L3-000290

STIG-Legacy|SV-75385

STIG-Legacy|V-60927

Vuln-ID|V-220133

AMLS-L3-000300 - The Arista Multilayer Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-217501r856151_rule

STIG-ID|AMLS-L3-000300

STIG-Legacy|SV-75387

STIG-Legacy|V-60929

Vuln-ID|V-217501

AMLS-L3-000320 - The Arista Multilayer Switch must not enable the RIP routing protocol.

Rule-ID|SV-217502r385516_rule

STIG-ID|AMLS-L3-000320

STIG-Legacy|SV-75391

STIG-Legacy|V-60933

Vuln-ID|V-217502

AMLS-L3-000330 - The Arista MLS RTR must be using a version supported by the vendor.

CAT|I

Rule-ID|SV-264429r992084_rule

STIG-ID|AMLS-L3-000330

Vuln-ID|V-264429

Detections

Analytics

DISA STIG Arista MLS DCS-7000 Series RTR v1r4

Audit Details

File Details

Audit Changelog

No revisions found