STIGQter: STIG Summary: Cisco IOS XR Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco PE router must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.

DISA Rule

SV-216799r531087_rule

Vulnerability Number

V-216799

Group Title

SRG-NET-000362-RTR-000119

Rule Version

CISC-RT-000710

Severity

CAT III

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VPLS bridge domain.

RP/0/0/CPU0:R3(config)#l2vpn
RP/0/0/CPU0:R3(config-l2vpn)#bridge group L2GROUP
RP/0/0/CPU0:R3(config-l2vpn-bg)# bridge-domain L2_BRIDGE_COI1
RP/0/0/CPU0:R3(config-l2vpn-bg-bd)#interface GigabitEthernet0/0/0/2
RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#igmp snooping profile default
RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#end

Check Contents

Review the router configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively for each VPLS bridge domain.

l2vpn
bridge group L2GROUP
bridge-domain L2_BRIDGE_COI1
interface GigabitEthernet0/0/0/2
igmp snooping profile default

If the router is not configured to implement IGMP or MLD snooping for each VPLS bridge domain, this is a finding.

Vulnerability Number

V-216799

Documentable

False

Rule Version

CISC-RT-000710

Severity Override Guidance

Review the router configuration to verify that IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively for each VPLS bridge domain.

l2vpn
bridge group L2GROUP
bridge-domain L2_BRIDGE_COI1
interface GigabitEthernet0/0/0/2
igmp snooping profile default

If the router is not configured to implement IGMP or MLD snooping for each VPLS bridge domain, this is a finding.

Check Content Reference

M

Target Key

4029

Comments