# Arista cEOS Does Not Apply ACLs to Control-Plane Traffic

DevFeed: [Arista cEOS Does Not Apply ACLs to Control-Plane Traffic](<https://devfeed.tech/articles/arista-ceos-does-not-apply-acls-to-control-plane-traffic-11421.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2026/08/arista-ceos-acl-control-plane-traffic/>)

Published: 2026-08-24T05:20:00Z

Content type: opinion

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [Network](<https://devfeed.tech/topics/network.md>), [BGP](<https://devfeed.tech/topics/bgp.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Finite-state machine](<https://devfeed.tech/topics/finite-state-machine.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [bgp](<https://devfeed.tech/tags/bgp.md>), [containers](<https://devfeed.tech/tags/containers.md>), [netlab](<https://devfeed.tech/tags/netlab.md>), [network](<https://devfeed.tech/tags/network.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

The article reports that Arista cEOS containers do not apply inbound ACLs to control-plane traffic or to traffic sent to the container's own IP addresses. This behavior differs from Arista vEOS virtual machines and can cause BGP connectivity tests using ACLs to produce unexpected results.

## Source excerpt

When someone starts singing the Use Digital Twins to Test Your Network hymn (or, more recently, tells you how AI agents can do that to validate their ideas), ask them about these minor details. If they persist, point them (not that it would help) to this long list of gotchas. That list just got longer: Arista cEOS container does not apply inbound ACLs to control-plane traffic (Arista vEOS VM does). Read more ...