Control Plane Policy Map

СреднийУровень 1Ручная проверкаarista-eos

Описание

The default configuration comes with a pre-configured policy map to ensure adequate rate limiting for most traffic types punted to the CPU. Control plane policing can be used to increase the security of Arista switches by protecting the control plane from unnecessary or malicious traffic. It is recommended to implement control plane protection by classifying traffic types based on importance ... CIS assessment: Manual. Reported as SKIP with review instructions.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

CIS assessment: Manual. Verify a policy map is applied to the control plane switch#show running-config all section system control-plane Expected output system control-plane ip access-group default-control-plane-acl in ip access-group default-control-plane-acl vrf MGMT in ipv6 access-group default-control-plane-acl in ipv6 access-group default-control-plane-acl vrf MGMT in service-policy input copp-system-policy switch# Check the configuration of the service policy #show policy-map type control-plane copp-system-policy Service-policy input: ...

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

If no policy is configured, enable the default policy system control-plane service-policy input copp-system-policy

Свойства

Операционные системы: Любая
Теги: arista-eosnetworkhardening
Источник: CIS Arista EOS Benchmark v1.0.0 - 1.1.3 Control Plane Policy Map