OpenControls Logo

STIG Viewer

STIGViewer Support

The Arista MLS layer 2 switch must have the native VLAN assigned to an ID other than the default VLAN for all 802.1q trunk links.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-255985ARST-L2-000220SV-255985r991779_ruleCCI-004891medium
Description
VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch that the victim is connected to. If the attacker knows the victim’s MAC address, it can forge a frame with two 802.1q tags and a layer 2 header with the destination address of the victim. Since the frame will ingress the switch from a port belonging to its native VLAN, the trunk port connecting to the victim’s switch will simply remove the outer tag because native VLAN traffic is to be untagged. The switch will forward the frame on to the trunk link unaware of the inner tag with a VLAN ID of which the victim’s switch port is a member.
STIGDate
Arista MLS EOS 4.X L2S Security Technical Implementation Guide2025-05-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CLD-03Cloud Infrastructure Security Subnet
0.50
NET-03.8Separate Subnet for Connecting to Different Security Domains
0.50
NET-06.1Security Management Subnets
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
SC-47Alternate Communications Paths
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-8Transmission Confidentiality and Integrity
1.00
CCI1 mapping
CCI-004891
1.00

Details

Check Text (C-255985r991779_chk)

Review the Arista MLS switch configuration for all trunk ports to have a unique native VLAN ID that is not the default VLAN 1 by using the following example: switch(config)#sh run | sec native vlan interface Ethernet4 description STIG Disable_VLAN 1 and native vlan to 1000 switchport trunk native vlan 1000 switchport trunk allowed vlan 2-4094 If the native VLAN has the same VLAN ID as the default VLAN, this is a finding.

Fix Text (F-59604r882296_fix)

Configure the interface trunk ports for the unique Native VLAN ID and configure the VLAN allowed by using the following commands: switch(config)#interface Ethernet10 switch(config-eth10)#description #STIG VLAN 1 Pruning switch(config-eth10)# switchport trunk native vlan 1000 switch(config-eth10)#switchport trunk allowed vlan 2-4094