What changed in Arista MLS DCS-7000 Series RTR STIG V1R4V1R4 changes

Arista MLS DCS-7000 Series RTR STIG V1R4 (2024-07-24) replaced V1R3 (2020-07-24): 22 checks added, 21 removed. It has 22 checks, against 21 in V1R3.

V1R4 checklistV1R3 checklist Compare V1R3 and V1R4 in STIG Compare

  • 22 added
  • 21 removed
  • 0 updated

Added in V1R4 (22)

  • V-217488CAT IIThe Arista Multilayer Switch must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
  • V-217489CAT IIThe Arista Multilayer Switch must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • V-217490CAT IIThe Arista Multilayer Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
  • V-217491CAT IIThe Arista Multilayer Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.
  • V-217492CAT IIThe Arista Multilayer Switch must be configured so inactive router interfaces are disabled.
  • V-217493CAT IIThe Arista Multilayer Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.
  • V-217494CAT IIIf Border Gateway Protocol (BGP) is enabled on The Arista Multilayer Switch, The Arista Multilayer Switch must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.
  • V-217495CAT IIThe Arista Multilayer Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.
  • V-217496CAT IIThe Arista Multilayer Switch must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.
  • V-217497CAT IIThe Arista Multilayer Switch must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.
  • V-217498CAT IIThe Arista Multilayer Switch must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.
  • V-217499CAT IIThe Arista Multilayer Switch must be configured to disable non-essential capabilities.
  • V-217500CAT IIThe Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol.
  • V-217501CAT IIThe Arista Multilayer Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.
  • V-217502CAT IIThe Arista Multilayer Switch must not enable the RIP routing protocol.
  • V-217523CAT IIThe Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP.
  • V-217524CAT IIThe Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
  • V-217525CAT IIThe Arista Multilayer Switch must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM) or are configured to meet RFC3682.
  • V-220130CAT IIThe Arista Multilayer Switch must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.
  • V-220131CAT IIThe Arista Multilayer Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • V-220133CAT IIThe Arista Multilayer Switch must configure the maximum hop limit value to at least 32.
  • V-264429CAT IThe Arista MLS RTR must be using a version supported by the vendor.

Removed since V1R3 (21)

  • V-60817CAT IIThe Arista Multilayer Switch must enforce approved authorizations for controlling the flow of information between interconnected networks in accordance with applicable policy.
  • V-60889CAT IIThe Arista Multilayer Switch must disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • V-60891CAT IIThe Arista Multilayer Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
  • V-60893CAT IIThe Arista Multilayer Switch must establish boundaries for IPv6 Admin-Local, IPv6 Site-Local, IPv6 Organization-Local scope, and IPv4 Local-Scope multicast traffic.
  • V-60895CAT IIThe Arista Multilayer Switch must be configured so inactive router interfaces are disabled.
  • V-60897CAT IIThe Arista Multilayer Switch must protect an enclave connected to an Alternate Gateway by using an inbound filter that only permits packets with destination addresses within the sites address space.
  • V-60899CAT IIIf Border Gateway Protocol (BGP) is enabled on The Arista Multilayer Switch, The Arista Multilayer Switch must not be a BGP peer with a router from an Autonomous System belonging to any Alternate Gateway.
  • V-60903CAT IIThe Arista Multilayer Switch must not redistribute static routes to alternate gateway service provider into an Exterior Gateway Protocol or Interior Gateway Protocol to the NIPRNet or to other Autonomous System.
  • V-60905CAT IIThe Arista Multilayer Switch must enforce that Interior Gateway Protocol instances configured on the out-of-band management gateway router only peer with their own routing domain.
  • V-60907CAT IIThe Arista Multilayer Switch must enforce that the managed network domain and the management network domain are separate routing domains and the Interior Gateway Protocol instances are not redistributed or advertised to each other.
  • V-60909CAT IIThe Arista Multilayer Switch must enforce that any interface used for out-of-band management traffic is configured to be passive for the Interior Gateway Protocol that is utilized on that management interface.
  • V-60911CAT IIThe Arista Multilayer Switch must enforce information flow control using explicit security attributes (for example, IP addresses, port numbers, protocol, Autonomous System, or interface) on information, source, and destination objects.
  • V-60913CAT IIThe Arista Multilayer Switch must enable neighbor router authentication for control plane protocols except RIP.
  • V-60915CAT IIThe Arista Multilayer Switch must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field via egress filter or by enabling Unicast Reverse Path Forwarding.
  • V-60917CAT IIThe Arista Multilayer Switch must be configured to disable non-essential capabilities.
  • V-60919CAT IIThe Arista Multilayer Switch must encrypt all methods of configured authentication for the OSPF routing protocol.
  • V-60921CAT IIThe Arista Multilayer Switch must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM) or are configured to meet RFC3682.
  • V-60923CAT IIThe Arista Multilayer Switch must manage excess bandwidth to limit the effects of packet flooding types of denial of service (DoS) attacks.
  • V-60927CAT IIThe Arista Multilayer Switch must configure the maximum hop limit value to at least 32.
  • V-60929CAT IIThe Arista Multilayer Switch must only allow incoming communications from authorized sources to be routed to authorized destinations.
  • V-60933CAT IIThe Arista Multilayer Switch must not enable the RIP routing protocol.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R4 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.