The Arista router must be configured to restrict traffic destined to itself.
An XCCDF Rule
Description
<VulnDiscussion>The route processor handles traffic destined to the router, the key component used to build forwarding paths that is also instrumental with all network management functions. Hence, any disruption or denial-of-service (DoS) attack to the route processor can result in mission-critical network outages.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-256016r882390_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Configure all Arista routers with receive path filters to restrict traffic destined to the router.
Step 1: Configure the Control plane policy to restrict the LLDP traffic to CPU.
router(config)#policy-map type copp copp-system-policy
router(config-pmap-copp-system-policy)#class copp-system-lldp