Arista MLS DCS-7000 Series L2S STIG Version Comparison

There are 2 differences between versions v1 r2 (April 22, 2016) (the "left" version) and v1 r3 (Jan. 25, 2019) (the "right" version).

Check AMLS-L2-000140 was removed from the benchmark in the "right" version. The text below reflects the old wording.

This check's original form is available here.

Title

The Arista Multilayer Switch must re-authenticate all endpoint devices every 60 minutes or less.

Check Content

This requirement only applies to devices required to employ 802.1X authentication. Verify that the network device uniquely identifies network-connected endpoint devices and re-authenticates devices every 60 minutes or less. This can be viewed via the "show dot1x all" command. Under the interface configuration for the .1X connected port, the following statements must be present: ReauthPeriod : 3600 seconds If the device does not require re-authentication, or if the re-authentication period is longer than 60 minutes, this is a finding.

Discussion

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity on the network. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk (e.g., remote connections). Bidirectional authentication solutions include, but are not limited to, IEEE 802.1x and Extensible Authentication Protocol (EAP) and Radius server with EAP-Transport Layer Security (TLS) authentication. A network connection is any connection with a device that communicates through a network (e.g., local area network, wide area network, or the Internet). Authentication must use a form of cryptography to ensure a high level of trust and authenticity. Re-authentication must occur to ensure session security.

Fix

Configure 802.1X on the switch, including the following mandatory parameters in the interface configuration mode: config interface Ethernet[X] dot1x reauthentication dot1x timeout reauth-period 3600