AMLS-L2-000140 - The Arista Multilayer Switch must re-authenticate all endpoint devices every 60 minutes or less - dot1x timeout reauth-period 3600

Information

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity on the network. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk (e.g., remote connections).

Bidirectional authentication solutions include, but are not limited to, IEEE 802.1x and Extensible Authentication Protocol (EAP) and Radius server with EAP-Transport Layer Security (TLS) authentication.

A network connection is any connection with a device that communicates through a network (e.g., local area network, wide area network, or the Internet).

Authentication must use a form of cryptography to ensure a high level of trust and authenticity. Re-authentication must occur to ensure session security.

Solution

Configure 802.1X on the switch, including the following mandatory parameters in the interface configuration mode:

config
interface Ethernet[X]
dot1x reauthentication
dot1x timeout reauth-period 3600

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_DCS-7000_Series_Y24M07_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1), CAT|II, CCI|CCI-001967, Rule-ID|SV-230143r971529_rule, STIG-ID|AMLS-L2-000140, STIG-Legacy|SV-75283, STIG-Legacy|V-60827, Vuln-ID|V-230143

Plugin: Arista

Control ID: be7a193e194a6f0fefbfbec16e53829027d59cf97a34998d2e695662f7290b92