End of Sale

v1.1 Updated January, 2021

This Policy Covers:

• MOS (Metamako Operating System)
• Supported 7130 Applications:
  • SwitchApp
  • MetaWatch
  • MetaMux
  • MultiAccess
  • MetaProtect
  • ExchangeApp
  • JTAG App

Policy:

Arista Networks' MOS and 7130 Apps Software Release Policy and Life Cycle guidelines help customers and partners facilitate MOS migration and plan multi-year infrastructure deployment. Arista will support designated LTS (Long term support) MOS and 7130 application software releases for up to 24 months from the date of the first posting of the initial minor release. (See below for definition of minor release)

To assist customers in selecting the right software releases for their environments, Arista follows a strict policy as to when new features are introduced into versions of MOS and applications. The versioning scheme identifies if a particular release is integrating new feature functionality, or a maintenance release on the previously released version.

The version numbers are defined by X.Y.Z[{alpha|beta}A]. X is the major release number, Y is the minor release number, Z is the patch release number. The alpha/beta tag identifies development releases which should not be deployed to production environments.

New minor releases -- i.e. where Z is 0 -- contain new functionality. New patch releases -- i.e. where Z is non-zero -- are maintenance releases.

Examples:

• mos-0.26.0 -- A new minor release. Contains new functionality compared with previous versions.
• mos-0.26.1 -- A new patch release. Only contains conservative bug fixes, compared with 0.26.0.
• mos-0.27.0beta1 -- A new development release. Do not use this in production environments.

Bug fixes are introduced using patch releases -- i.e. an upgrade to the latest patch release for the minor release number will be required to receive new bugfixes for that train.

Development releases (alpha/beta) carry no support commitment, though feedback is always welcomed.

Arista applications use the same versioning scheme as MOS. For example:

• metamux-3.5.6

Certain minor releases may be designated as "LTS" (Long Term Support). These will be supported with patch releases for 24 months following initial release of the .0 image. The LTS status of releases will be indicated in the release's description on the 7130 software downloads site. Releases other than LTS releases have no specific support timeline.

TAC support will be available on all versions of MOS and apps for 30 months following release.

If you need assistance with MOS or 7130 application software migration options, please contact your Arista sales representative or contact us at このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。

Arista Vulnerability Management Process

An organization's communications infrastructure and the tools that support it are critical to a business's ability to function. This importance also makes the infrastructure a high-value target for malicious actors seeking to gain entry deeper into the organization or to exfiltrate sensitive intellectual property. Arista Networks sees its role in security as a continuous process that begins at manufacturing and continues throughout the lifecycle of the product as vulnerabilities are detected, mitigated, and remediated.

This vulnerability management process encompasses several primary components: Secure Development Best Practices, Vulnerability Discovery, Mitigation and Remediation, and Vulnerability Communication. Product security must also be complemented through best practice configuration during the installation and operation of the infrastructure.

Arista Vulnerability Management Process

Secure Development Best Practices: A Secure-by-Design Philosophy

Both the design of new Arista features and the maintenance of our existing portfolio—including EOS^®, DANZ Monitoring Fabric (DMF)™, CloudVision (CV)™, CloudVision CUE™, Enterprise Threat Management (ETM), Network Detection and Response (NDR), and VeloCloud—are driven by security as a foundational priority.

Arista ensures the inherent security of our products through a proactive, secure-by-design methodology. Rather than relying solely on post-development testing, our goal is to eliminate vulnerabilities before they ever see the light of day. We achieve this by combining memory-safe development with rigorous defensive programming, all reinforced by a culture of continuous vigilance.

1. A Memory-Safe Technical Foundation: We eliminate entire classes of common vulnerabilities (such as buffer overflows and memory leaks) directly at the source code level:
   
    
   • Memory-Safe Languages: The majority of our products are built using inherently memory-safe languages like Go, Java, and Python. For performance-critical components, we utilize a custom meta-language that combines the speed of C++ with the rigorous safety checks expected of a more secure language.
      
   • Defensive Coding Practices: Our development pipeline mandates automated bounds checking on each operation, enforces safe initialization (defaulting pointers and data structures to safe, NULL values upon creation), and prevents resource leaks through safe memory operations, reference counting, and Valgrind analysis.
      
    
2. Resilient Execution & Architecture: Our software architecture is explicitly designed to prevent complex execution flaws and unauthorized data manipulation:
   
    
   • Safe Concurrency: We eliminate race conditions and deadlocks by treating each program as a single thread of execution that communicates safely with other programs to share data, rather than sharing memory directly.
      
   • Input Sanitization: To proactively neutralize the risk of malformed data injection, all internal and external APIs enforce strict, uncompromising input sanitization.
      
    
3. Proactive Security Culture & Supply Chain Trust: The human element and the supply chain are critical to our secure development lifecycle:
   
    
   • Continuous Threat Awareness: Our Product Security Incident Response Team (PSIRT) continuously monitors the threat landscape for emerging attack vectors, actively integrating these rising trends into company-wide engineering training.
      
   • Empowered Engineers: Arista engineers receive ongoing, specialized training designed to help them architect inherently secure features and easily identify insecure design patterns during peer reviews.
      
   • Strict Library Auditing: We proactively reduce supply chain risk by strictly limiting the usage of security-critical open-source software to highly audited, universally well-understood libraries.

Vulnerability Discovery - A Proactive and Prevention First Approach

Arista uses a multi-layered, proactive approach to detect emerging vulnerabilities across every major release. By combining advanced automation, artificial intelligence, and expert manual review, we ensure comprehensive coverage of our software supply chain and internal codebase.

• Automated Threat & Supply Chain Monitoring: Arista continuously scans for publicly disclosed vulnerabilities across our entire product portfolio using SBOM scanners, open-source review tools (nmap, static linters, dynamic memory analysis tools), and commercial scanners (Rapid7, Qualys, Tenable). This is heavily augmented by automated threat ingestion from the National Vulnerability Database (NVD) and close communication with third-party vendors.
   
• Frontier AI & Penetration Testing: Arista conducts traditional penetration testing utilizing both internal teams and external qualified third-party organizations for compliance, application, network, web, and red team testing.  We act as an early adopter of advanced AI-driven security discovery. By leveraging frontier AI models (such as Anthropic and OpenAI), we utilize AI harnesses for advanced threat modeling, automated proof-of-concept testing, comprehensive assessment and continuous auditing to actively defend against autonomous zero-day vulnerabilities.
   
• Rigorous Manual Auditing & Architecture Review: Specialized PSIRT engineers and vetted outside consultants manually validate all automated scan results. These teams conduct ongoing, detailed reviews of design documentation, internal host configurations (boot loaders, kernels, networking stacks), and high-risk code—particularly functions that parse user input or handle external packets.
   
• Accurate Evaluation & Industry Alignment: When vulnerabilities are identified, Arista carefully evaluates them using CVSS v3.1/v4.0 scoring to reflect their actual impact in the context of Arista products. All security baselines are strictly aligned with industry standards, including official CIS Hardening Benchmarks and our living Arista EOS Hardening Guide.

Mitigation and Remediation: Flexible, Low-Impact Patching

When a security vulnerability is identified, traditional network OS upgrades often force disruptive system reboots and significant downtime. To give customers maximum flexibility and immediate protection, Arista provides a staged remediation strategy designed to secure environments rapidly while minimizing operational impact.

1. Rapid Risk Reduction via Configuration Mitigation: As an immediate first line of defense, Arista prioritizes providing clear, highly effective configuration changes whenever possible to mitigate the risk of an active vulnerability. These documented workarounds allow customers to swiftly secure their environments—such as by altering access controls or temporarily disabling an affected service—blocking the attack vector while teams evaluate patch deployment strategies.
    
2. Targeted Patching via Hotfixes: For many vulnerabilities, Arista can provide a targeted hotfix rather than requiring a full OS upgrade. Delivered as an extension, a hotfix installs directly onto a running system to patch the specific vulnerable component without forcing a system-wide reboot.
   
    
   • Real-World Example: If a publicly disclosed CVE impacts the SSH Server, Arista can release a hotfix to resolve it. Upon installation, only the SSH service restarts—causing less than a second of service-specific downtime. All other switch services, routing protocols, and traffic forwarding remain completely unaffected.
      
   • The Advantage: Hotfixes provide immediate remediation that persists across switch reboots. This allows our customers to secure the device instantly and defer a full OS upgrade to a regularly scheduled maintenance window.
    
3. Seamless OS Updates via Smart System Upgrade (SSU) For vulnerabilities that do require a complete OS update, Arista eliminates the friction of traditional upgrades using our Smart System Upgrade (SSU)—an advanced In-Service Software Upgrade (ISSU) capability built into Arista EOS. Learn more at EOS: Smart System Upgrade.
   
    
   • How it works: SSU allows the switch to reload its entire operating system with less than one second of data-plane downtime.
      
   • The Advantage: Because SSU performs the upgrade without resetting the forwarding ASIC, single-homed and active connections remain alive. This provides an ability to apply comprehensive OS-level remediation and load the newest, fully patched image without dropping critical traffic or triggering broader network topology recalculations.
    
4. Our Remediation Philosophy When it comes to engineering resource allocation, Arista operates under a strict mandate: securing our customers is our absolute highest priority. The development, testing, and delivery of fixes for security vulnerabilities will always take precedence over new product enhancements or feature upgrades. We are committed to ensuring our customers have the patches they need, as quickly as possible, without compromise.

Communication: Transparent Disclosure

To help our customers keep pace with the rapid rate of modern vulnerability discovery, Arista prioritizes transparent, flexible, and proactive communication. We provide the critical information required for effective risk management through a variety of delivery options and release schedules tailored to the urgency of the threat.

1. Flexible Advisory Release Strategies: Arista utilizes two distinct timelines for releasing security advisories, ensuring that our communication matches the operational needs of our customers:
   
    
   • Scheduled Grouped Releases (Predictable): To coordinate communications and streamline patching efforts, Arista publishes routine advisories on a predictable, regular release schedule. When a larger volume of advisories is scheduled, we consolidate them into a single bulk publication and issue a 1-week advance public notification. This courtesy notice allows organizations to strategize and allocate resources before the technical details are published.
      
   • Time-Sensitive Releases (Immediate): For critical, externally disclosed, or actively exploited vulnerabilities, Arista bypasses the scheduled cycle. These advisories are published immediately as time-sensitive releases without advance notice, ensuring our customers have the information needed to protect an environment instantly.
    
2. Standardized, Actionable Content: When Arista publishes an advisory, our goal is to provide a complete risk management package rather than just a vulnerability notification.
   
    
   • Comprehensive Solutions: Every advisory includes actionable remediation paths. While a full software image upgrade is always provided, we also strive to include recommended configuration mitigations and targeted software hotfixes depending on the vulnerability.
      
   • MITRE CVE Tracking: Arista strictly follows industry best practices by assigning official CVEs via MITRE to all security issues. This ensures our vulnerabilities can be easily and accurately tracked across most internal security scanners, third-party advisories, and compliance management procedures.
    
3. Proactive Delivery & Automation: We offer multiple channels for vulnerability disclosure, allowing our customers to consume security data in the way that best fits individual operational workflows:
   
    
   • Public Portal & Push Notifications: All security vulnerabilities and their associated solutions are documented publicly on the Arista Advisories and Notices page. Customers can also opt into proactive alerts via email updates and RSS feeds.
      
   • Automated Evaluation via CloudVision AlertBase: For customers utilizing CloudVision, AlertBase automatically ingests updates about new security advisories and proactively evaluates the vulnerability status of all EOS devices managed by that instance. This speeds up the remediation process and transforms manual advisory reading into automated fleet auditing.

Summary

Arista goes to great lengths to ensure the ongoing security of its products and rapid mitigation of emerging threats, following industry best practices and leveraging close relationships with suppliers. The effectiveness of these robust processes is demonstrated by extremely limited exposure to common security issues as well as rapid and usually impact-free solutions for remediation. Arista customers following our recommended hardening steps can be confident that they have deployed the industry's leading secure networking solutions.

Arista Networks Product Life Cycle Policy for:

DANZ Monitoring Fabric (DMF), Converged Cloud Fabric (CCF) and Multi Cloud Director (MCD)

Life Cycle Policy updated: June 4, 2026

This document covers both software and hardware appliance life cycle policy for DMF, CCF and MCD, as applicable.

DMF, CCF and MCD Software Life Cycle

Arista Networks DANZ Monitoring Fabric (DMF), Converged Cloud Fabric (CCF) and Multi Cloud Director (MCD) Software Release Policy and Life Cycle guidelines help customers and partners facilitate DMF, CCF and MCD migration and plan multi-year infrastructure deployment. Arista will support each major DMF, CCF and MCD software release for up to 36 months from the date of initial posting for a particular train.

To assist customers in selecting the right DMF / CCF / MCD software release for their environments, Arista follows a standard naming convention for DMF / CCF / MCD releases. The naming convention identifies if a particular release is integrating new feature functionality, or has reached software maintenance mode.

Version numbering scheme:
<major version>.<minor version>.<patch version>

The Product Lifecycle policy guidelines apply to all major and minor releases only. Patch releases will follow the end-of-life policy milestones of the corresponding minor release.

Maintenance Phase

• DMF, CCF and MCD software releases in this phase will only receive incremental fixes. No new functionality will be added.
• TAC support available

Support Only Phase

• DMF, CCF and MCD software releases in this phase will receive ongoing TAC support only.
• Software upgrade required for bug fixes

End of Software Support

• Upon completion of the Support Only Phase, the release is designated as ‘End of Software Support’ after which no further Arista software support including maintenance for that release would be provided.

DANZ Monitoring Fabric Software Lifecycle

The following table depicts the Arista DMF release support matrix, including the timelines for each major Arista DMF software train (based on the 36 month lifecycle policy) and the current state of TAC support for each train.

Note: Future dates are for general planning purposes and are subject to change

Converged Cloud Fabric Software Lifecycle

The following table depicts the Arista CCF release support matrix, including the timelines for each major Arista CCF software train (based on the 36 month lifecycle policy) and the current state of TAC support for each train.

Note: Future dates are for general planning purposes and are subject to change

Multi Cloud Director (MCD) Software Lifecycle

The following table depicts the Arista MCD release support matrix, including the timelines for each major Arista MCD software train (based on the 36 month lifecycle policy) and the current state of TAC support for each train.

Note: Future dates are for general planning purposes and are subject to change

DMF and CCF Hardware Appliance Life Cycle

As technology evolves, there comes a time when it is better for our customers to transition to newer platforms. Arista's End-of-Sale and End-of-Life policy is designed to help customers identify such life-cycle transitions and plan their infrastructure deployments with a multi-year outlook.

All End-of-Sale and End-of-Life announcements will be made on Arista's website. Milestones in the life cycle of our products is as follows:

• An End-of-Sale announcement will be posted on our website 6 months prior to the last day to order the product
• All customers who have a valid software license and a valid service contract will receive 24x7 support from Arista TAC for up to 5 years from the end-of-sale date or till the manufacturer’s end-of-life date of the hardware, whichever is sooner.
• Software bug fixes will be available for up to 3 years from the end-of-sale date. Fixes for critical security vulnerabilities will be available through the end of life. Customers may be required to upgrade to a newer software release to get the bug fixes.
• Hardware repair or replacement will be available for 5 years from the end-of-sale date or till the manufacturer's end-of-life date of the hardware, whichever is sooner.
• Customers can renew service contracts up to 1 year prior to the end-of-life date.

End-of-Sale & End-of-Life Milestones at a Glance

Note: * HW repair or replacement will be available for 5 years from the end-of-sale date or till the manufacturer’s end-of-life date for the hardware, whichever is sooner.

Hardware Appliance Life Cycle

(Controller Appliance, Service Node, Recorder Node, Analytics Node)

Arista Switch Hardware Lifecycle

For Arista Switch HW End-of-Life policy, please visit: https://www.arista.com/en/support/product-documentation/five-year-end-of-life-policy  

For Arista Switch HW product life cycle, please visit: https://www.arista.com/en/support/product-lifecycle

Dell EMC Switch Hardware Lifecycle

Note: Arista and Dell have jointly decided to terminate their partnership on DMF/CCF. Arista will only support Dell switch deployments with DMF/CCF for up to the End of Life of the respective switch hardware or 31-Dec-2028, whichever is sooner. Please refer to Arista Dell Partnership Termination Field Notice for details.
For assistance with new / expansion / migration opportunities, please contact your Arista sales representative or contact us at このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。

For Dell EMC Switch HW End-of-Life, please visit: https://www.dell.com/en-us/work/shop/networkingwarranty/cp/networkingwarranty  

DMF / CCF support on Accton / Edgecore Switch Hardware

DMF / CCF deployments running on Accton / Edgecore switches are no longer supported by Arista effective 01-Dec-2024. Customers using Accton / Edgecore switches with their DMF / CCF deployments are strongly encouraged to migrate their deployments from Accton / Edgecore to Arista hardware platforms as soon as possible. This migration is crucial to ensure continued support and access to the latest features and security updates. Please contact the Arista Sales team for guidance on Arista hardware platforms and migration options.

DMF / CCF Support on HPE Switch Hardware

DMF deployments running on HPE switches are no longer supported by Arista effective 01-Dec-2024.
CCF deployments running on HPE switches are no longer supported by Arista effective 01-Jun-2023.
Customers using HPE switches with their DMF / CCF deployments are strongly encouraged to migrate their deployments from HPE to Arista hardware platforms as soon as possible. This migration is crucial to ensure continued support and access to the latest features and security updates. Please contact the Arista Sales team for guidance on Arista hardware platforms and migration options.

If you need assistance with DMF/CCF solutions, please contact your Arista sales representative or contact us at: このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。

CloudVision Software Lifecycle

• CloudVision Portal (CVP) – software deployed on-premises
• CloudVision Appliance Software (CVA) – software deployed on the CloudVision hardware appliance
• CloudVision as-a-Service (cloud service) – referred to in this document for EOS and Streaming Agent support only

The Software Release Policy and Lifecycle defines the various phases of development and support to guide customers in transitioning to newer versions of the product based on the milestones in the lifecycle. Arista Networks will support each major software release train of CloudVision Portal and the CloudVision Appliance Software for up to 24 months from the general availability date for a particular train. The following diagram depicts the release phases and the Arista TAC support mapping across this timeline.

• Major release with new features and functionality
• Active maintenance releases for bug fixes as needed
• TAC support available

• Ongoing TAC support
• Software upgrade required for bug fixes

The following table depicts the CloudVision Portal release support matrix, including the timelines for each major software train (based on the 24 month life cycle policy) and includes the current state of support for each train.

As technology evolves, there comes a time when it is better for our customers to transition to newer platforms. Arista's End-of-Sale and End-of-Life policy is designed to help customers identify such life-cycle transitions and plan their infrastructure deployments with a multi year outlook.

All End-of-Sale and End-of-Life announcements will be made on Arista's website. As of September 2018 Arista is extending some of the timelines for related milestones in the life cycle of our products as follows:

• An End-of-Sale announcement will be posted on our website 6 months prior to the last day to order the product
• All customers who have a valid service contract will receive 24x7 support from Arista TAC for up to 5 years from the end-of-sale date of the product. This last day to get support will be referred to as the end-of-life date for the product.
• Software bug fixes will be available for up to 3 years from the end-of-sale date. After the first 3 years, Arista will make commercially reasonable efforts in assisting customers to mitigate Arista identified critical security vulnerabilities through the applicable end of life date. Customers may be required to upgrade to a newer software release to get the bug fixes, if available.
• Hardware repair or replacement will be available for up to 5 years from the end-of-sale date.
• Customers can renew service contracts up to 1 year prior to the end-of-life date.

End-of-Sale & End-of-Life Milestones at a Glance

Figure 1: CloudEOS Router Software Licensing summary

Arista CloudEOS Router Licensing Model

Figure 2: CloudEOS Router product options

CloudEOS Router VM

CloudEOS Router VM is offered in each cloud provider marketplace under either a pre-purchased Bring-Your-Own-License (BYOL) subscription model or via Pay-As-You-Go (PAYG) hourly or annual consumption-based billing. It is also available for download for on-premise use via Arista’s Software Downloads page as BYOL only. For more details, please refer to CloudEOS Router VM datasheet.

Pay-As-You-Go (PAYG) Consumption Model

Under PAYG model, customers will be charged software subscription fees based on hourly or annual usage rates that have been set for the product. PAYG billing will be done via the cloud provider billing cycle. A benefit of the PAYG model is that the customers can start using CloudEOS Router immediately and pay only for the amount that they consume. Note that PAYG consumption does not require the customers to obtain a quote, generate a purchase order or to manage licenses, making it the preferred and de facto consumption model for most public cloud resources.

Bring-Your-Own-License (BYOL) Purchase Model

Under the BYOL model, customers will need to purchase monthly subscription SKUs from Arista in order to activate and use the CloudEOS Router. The BYOL customer will pay Arista directly for the subscription in advance and will be provided with license activation keys and proof of entitlement for the term of their subscription.

CloudEOS Router Container

CloudEOS Router Container is offered in on-premises Kubernetes deployment under Bring-Your-Own-License (BYOL) monthly subscription model. For more details, please refer to CloudEOS Router Container datasheet.

Figure 1: CloudVision Software Licensing summary

Arista CloudVision is licensed on a term-based software subscription model.. There are two functional tiers of CloudVision licenses available - CloudVision and CloudVision Lite. The full CloudVision feature set includes full analytics, telemetry, and provisioning. CloudVision Lite is an entry-level subset of the capabilities, providing a functional graphical user interface (GUI) for base visibility and network management. The feature sets for these licenses are defined below in Figure 2.

Figure 2: Mapping of Software features to CloudVision License

EOS offers extensive automation, security, telemetry, and integration capabilities for customers looking for modern network operations. Customers can automate their network, deploy segmentation, develop custom extensions and integrate existing analytics and/or security systems with the feature sets available in the Z and ‘V2’ licenses. The feature sets for these licenses are defined below in Figure 3.

Figure 3: Mapping of EOS Software features for the perpetual Z and V2 licenses

Arista EOS offers a broad range of advanced features through the feature sets shown in diagram below.

Figure 1: Software license to feature mapping

EOS licenses are offered as perpetual licenses applied on a per-system basis. Customers can choose the appropriate license, as shown in figure 1, based on the features required for the profile for which the system is to be deployed. The Platform to License SKU mapping is available here.