- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 161 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 157 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 151 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 154 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 154 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 166 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 162 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 162 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Can Sun
- Posted on June 19, 2025
- Updated on June 19, 2025
- 167 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Ziqian XU
- Posted on October 21, 2021
- Updated on October 21, 2021
- 10777 Views
Support for AES GCM has been added as a method for storing symmetric secrets in EOS. This applies to secrets that must be
- Written by Himanshu Singh
- Posted on April 25, 2025
- Updated on April 25, 2025
- 971 Views
Automatic certificate management provides support for retrieving signed x509v3 certificates from a server under the Enrollment over Secure Transport (EST) protocol, described in RFC 7030. The feature provides only EST client capabilities.
- Written by Leandro Penz
- Posted on August 21, 2020
- Updated on August 21, 2020
- 9063 Views
Dynamic CLI Access VLAN is a command that sets the effective access VLAN in a port without changing the running
- Written by Jeevan Kamisetty
- Posted on August 23, 2022
- Updated on November 30, 2023
- 12127 Views
NDR switch sensor aka “monitor security awake” feature provides deep network analysis by doing deep packet inspection of some or all packets of traffic that's forwarded by the switch.
- Written by Can Sun
- Posted on December 20, 2024
- Updated on December 20, 2024
- 1806 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, which is associated with a revision number to help the user identify changes to the event.
- Written by Aman Aman-Ul-Haq
- Posted on March 9, 2021
- Updated on December 1, 2023
- 13703 Views
The Segment security feature provides the convenience of applying policies on segments rather than interfaces or subnets. Hosts/networks are classified into segments based on prefixes. Grouping prefixes into segments allows for definition of policies that govern flow of traffic between segments.
- Written by Pedro Coutinho
- Posted on June 10, 2019
- Updated on June 11, 2019
- 10667 Views
This feature involves the use of packet’s Time to Live (TTL) (IPv4) or Hop Limit (IPv6) attributes to protect
- Written by Pedro Coutinho
- Posted on August 25, 2016
- Updated on June 11, 2019
- 11294 Views
This feature involves the use of packet’s Time to Live (TTL) (IPv4) or Hop Limit (IPv6) attributes to protect
- Written by Can Sun
- Posted on December 20, 2024
- Updated on December 20, 2024
- 1793 Views
Measured boot is an anti-tamper mechanism. It calculates the cryptographic signatures for software system components and extends the signatures into the Trusted Platform Module (TPM) security chip. Upon startup, with the feature turned on, the Aboot bootloader and EOS calculate the hash of various system components and extend the hashes into the Platform Configuration Registers (PCRs), which is one of the resources of the Trusted Platform Module (TPM) security chip. The calculation and extension event is called the measured boot event, and the event is associated with a revision number to help the user identify changes to the event.
- Written by Thejesh Panchappa
- Posted on December 30, 2021
- Updated on December 30, 2021
- 9811 Views
Macro Segmentation Service with Layer 3 firewall (MSS FW) provides a mechanism to offload policy enforcement on TORs
- Written by Arup Raton Roy
- Posted on September 7, 2021
- Updated on September 21, 2021
- 9656 Views
Macro Segmentation Service with Layer 3 firewall (MSS FW) enforces all security policies bi directionally by
- Written by Ben May
- Posted on February 1, 2024
- Updated on February 1, 2024
- 5098 Views
This can be done with multiple groups today, as long as we have enough unique group entries in hardware. In the absence of this configuration ( default behavior ), bridged traffic will be assigned to the default VRF and policies of default VRF will be applied to bridged traffic. With this feature, bridged traffic is never subject to MSS-G configuration.
- Written by Coy Humphrey
- Posted on September 15, 2020
- Updated on June 7, 2024
- 13956 Views
This TOI describes a set of enhancements made to the existing Port Security: Protect Mode (PortSec-Protect) feature. Please see the existing TOI for this feature here:Port Security: Protect Mode
- Written by Baptiste Covolato
- Posted on June 17, 2019
- Updated on June 27, 2025
- 11004 Views
Secure boot is a security feature available in Aboot (Arista bootloader) that verifies the cryptographic signature of the EOS SWI (software image) before it is booted. Aboot embeds certificates that allow it to recognize and validate official EOS releases from Arista. If the signature verification is successful, the secure boot check passes and Aboot proceeds to boot the SWI. If the signature verification fails, the boot is aborted.
- Written by Robert Hrusecky
- Posted on September 12, 2024
- Updated on September 12, 2024
- 2759 Views
Prior to 4.32.2F, the “reset system storage secure” CLI command can be used to perform a best-effort storage device wipe of all sensitive data. However, this command has the limitation that it wipes EOS from the storage device, leaving the system “stuck” in Aboot. The “reset system storage secure rollback” command provides the same secure erase functionality, but additionally allows the user to preserve a subset of files on the main flash device by copying them into RAM during the secure erase procedure. The set of files that are preserved is configurable. After a successful wipe, the system will return to EOS after the erase is complete if the EOS SWI image and adequate configuration files are preserved (such as boot-config and startup-config).
- Written by Eudean Sun
- Posted on April 30, 2025
- Updated on April 30, 2025
- 734 Views
The Linux audit system provides the ability to record security events on the switch. Audit rules must be configured and enabled at the CLI. Audit rules can be configured in different groups to assist with organization and maintenance.
- Written by Michelle Wang
- Posted on June 8, 2020
- Updated on July 21, 2023
- 9994 Views
EOS provides a way to extend its capabilities through the installation of extensions. An extension is a pre packaged
- Written by Ronan Mac Fhlannchadha
- Posted on October 14, 2024
- Updated on November 11, 2024
- 2262 Views
This supports checking that the value of a given x509 certificate OID matches a user-provided value during the TLS handshake in OpenConfig. If the value does not match, no connection will be established.
- Written by Wenyi Cheng
- Posted on April 19, 2021
- Updated on July 19, 2023
- 11297 Views
This feature adds TLS support to the existing syslog logging mechanism. With the new added CLI commands, the user can
- Written by Yuyang Chen
- Posted on June 15, 2021
- Updated on June 21, 2021
- 10874 Views
Port wide port security: Port security with address limit on the port configured by the existing shutdown mode port