STIGQter: STIG Summary: Cisco IOS XR Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.

DISA Rule

SV-216813r531087_rule

Vulnerability Number

V-216813

Group Title

SRG-NET-000362-RTR-000121

Rule Version

CISC-RT-000850

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

Configure the RP to rate limit the number of multicast register states.

RP/0/0/CPU0:R2(config)#router pim
RP/0/0/CPU0:R2(config-pim)#address-family ipv4
RP/0/0/CPU0:R2(config-pim-default-ipv4)#maximum register-states 250
RP/0/0/CPU0:R2(config-pim-default-ipv4)#end

Check Contents

Review the configuration of the RP to verify that it is limiting the number of PIM register states as shown in the example.

router pim
address-family ipv4
allow-rp group-list FILTER_PIM_JOINS
rp-address 10.2.2.2
accept-register PIM_REGISTER_FILTER
maximum register-states 250

Note: The maximum register-states command is used to set an upper limit for PIM register states. When the limit is reached, PIM discontinues route creation from PIM register messages. If not configured, the default is 2000 which would be an overage for a small to average size multicast deployment.

If the RP is not limiting PIM register states, this is a finding.

Vulnerability Number

V-216813

Documentable

False

Rule Version

CISC-RT-000850

Severity Override Guidance

Review the configuration of the RP to verify that it is limiting the number of PIM register states as shown in the example.

router pim
address-family ipv4
allow-rp group-list FILTER_PIM_JOINS
rp-address 10.2.2.2
accept-register PIM_REGISTER_FILTER
maximum register-states 250

Note: The maximum register-states command is used to set an upper limit for PIM register states. When the limit is reached, PIM discontinues route creation from PIM register messages. If not configured, the default is 2000 which would be an overage for a small to average size multicast deployment.

If the RP is not limiting PIM register states, this is a finding.

Check Content Reference

M

Target Key

4029

Comments