CIS Arista EOS Benchmark

This recommendation verifies that SSH Is Enabled for Management Access on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that SSH Is Enabled for Management Access:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Telnet Is Disabled on the Arista EOS network device. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Arista EOS network device increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Review the running configuration and verify that Telnet Is Disabled:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that HTTP Server Is Disabled on the Arista EOS network device. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Arista EOS network device increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Review the running configuration and verify that HTTP Server Is Disabled:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that HTTPS Uses Strong TLS Configuration on the Arista EOS network device. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Arista EOS network device uses the correct component aligns with industry best practices and standards.

Review the running configuration and verify that HTTPS Uses Strong TLS Configuration:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Management Interface Is on Dedicated VRF on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Management Interface Is on Dedicated VRF:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Console Timeout Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Console Timeout Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that VTY Lines Use SSH Only on the Arista EOS network device. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Arista EOS network device uses the correct component aligns with industry best practices and standards.

Review the running configuration and verify that VTY Lines Use SSH Only:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This setting ensures that VTY Access Is Restricted by ACL on the Arista EOS network device. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Arista EOS network device is essential for defense in depth.

Review the running configuration and verify that VTY Access Is Restricted by ACL:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Session Timeout Is Configured for VTY on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Session Timeout Is Configured for VTY:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Default Admin Password Is Changed on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Default Admin Password Is Changed:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Local User Passwords Use Strong Hashing on the Arista EOS network device. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Arista EOS network device uses the correct component aligns with industry best practices and standards.

Review the running configuration and verify that Local User Passwords Use Strong Hashing:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Enable Secret Is Configured with Strong Hash on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Enable Secret Is Configured with Strong Hash:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that TACACS+ or RADIUS Authentication Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that TACACS+ or RADIUS Authentication Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that AAA Authorization Is Configured for Commands on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that AAA Authorization Is Configured for Commands:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that AAA Accounting Is Enabled for All Commands on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that AAA Accounting Is Enabled for All Commands:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Local Fallback Authentication Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Local Fallback Authentication Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that BGP Neighbor Authentication Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that BGP Neighbor Authentication Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that OSPF Authentication Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that OSPF Authentication Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that BGP Maximum Prefix Limits Are Set on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that BGP Maximum Prefix Limits Are Set:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Route Filtering Is Applied to BGP Peers on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Route Filtering Is Applied to BGP Peers:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Control Plane ACL Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Control Plane ACL Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Rate Limiting Is Applied to Control Plane Traffic on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Rate Limiting Is Applied to Control Plane Traffic:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that LLDP Is Disabled on Untrusted Interfaces on the Arista EOS network device. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Arista EOS network device increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Review the running configuration and verify that LLDP Is Disabled on Untrusted Interfaces:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that ACLs Are Applied to All External Interfaces on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that ACLs Are Applied to All External Interfaces:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Anti-Spoofing ACLs Are Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Anti-Spoofing ACLs Are Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Bogon Filtering Is Applied on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Bogon Filtering Is Applied:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Unused Ports Are Shut Down on the Arista EOS network device. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Arista EOS network device uses the correct component aligns with industry best practices and standards.

Review the running configuration and verify that Unused Ports Are Shut Down:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Port Security Is Enabled on Access Ports on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Port Security Is Enabled on Access Ports:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that DHCP Snooping Is Enabled on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that DHCP Snooping Is Enabled:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Dynamic ARP Inspection Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Dynamic ARP Inspection Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Storm Control Is Configured on Access Ports on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Storm Control Is Configured on Access Ports:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Syslog Is Configured with Remote Server on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Syslog Is Configured with Remote Server:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Logging Level Is Set to Informational or Higher on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Logging Level Is Set to Informational or Higher:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Logging Timestamps Are Enabled on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Logging Timestamps Are Enabled:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Logging Source Interface Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Logging Source Interface Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that SNMP Is Configured with SNMPv3 on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that SNMP Is Configured with SNMPv3:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that SNMP Community Strings Are Not Default on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that SNMP Community Strings Are Not Default:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that NTP Is Configured with Authentication on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that NTP Is Configured with Authentication:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that EOS Version Is Current and Supported on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that EOS Version Is Current and Supported:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Unused Services Are Disabled on the Arista EOS network device. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Arista EOS network device uses the correct component aligns with industry best practices and standards.

Review the running configuration and verify that Unused Services Are Disabled:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Configuration Is Saved After Changes on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Configuration Is Saved After Changes:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Login Banner Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Login Banner Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that MOTD Banner Is Configured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that MOTD Banner Is Configured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory

This recommendation verifies that Password Recovery Mechanism Is Secured on the Arista EOS network device. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Arista EOS network device vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the running configuration and verify that Password Recovery Mechanism Is Secured:

show running-config | include ...

Apply the following configuration in EOS CLI:

configure terminal
...
end
write memory