The Arista network device must be configured to audit all administrator activity.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-255951	SRG-APP-000026-NDM-000208	ARST-ND-000150	SV-255951r960777_rule	2025-02-20	2

Description
This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement. Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000080-NDM-000220, SRG-APP-000091-NDM-000223, SRG-APP-000101-NDM-000231, SRG-APP-000319-NDM-000283, SRG-APP-000343-NDM-000289, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000506-NDM-000323

Description

This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement. Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000080-NDM-000220, SRG-APP-000091-NDM-000223, SRG-APP-000101-NDM-000231, SRG-APP-000319-NDM-000283, SRG-APP-000343-NDM-000289, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000506-NDM-000323

ℹ️ Check
Verify the Arista network device is configured to audit all administrator activity. Verify the AAA logging settings in the configuration file with the following example: switch#show running-config \| section aaa aaa authentication policy on-success log aaa authentication policy on-failure log aaa accounting exec default start-stop group radius logging aaa accounting system default start-stop group radius logging aaa accounting commands all default start-stop logging group radius If the Arista network device is not configured to audit all administrator activity, this is a finding.

ℹ️ Check

Verify the Arista network device is configured to audit all administrator activity. Verify the AAA logging settings in the configuration file with the following example: switch#show running-config | section aaa aaa authentication policy on-success log aaa authentication policy on-failure log aaa accounting exec default start-stop group radius logging aaa accounting system default start-stop group radius logging aaa accounting commands all default start-stop logging group radius If the Arista network device is not configured to audit all administrator activity, this is a finding.

✔️ Fix
Configure the Arista network device to audit all administrator activity. Configure the AAA settings to capture administrator activity events. switch(config)#aaa authentication policy on-success log switch(config)#aaa authentication policy on-failure log switch(config)#aaa accounting exec default start-stop group radius logging switch(config)#aaa accounting system default start-stop group radius logging switch(config)#aaa accounting commands all default start-stop logging group radius

✔️ Fix

Configure the Arista network device to audit all administrator activity. Configure the AAA settings to capture administrator activity events. switch(config)#aaa authentication policy on-success log switch(config)#aaa authentication policy on-failure log switch(config)#aaa accounting exec default start-stop group radius logging switch(config)#aaa accounting system default start-stop group radius logging switch(config)#aaa accounting commands all default start-stop logging group radius