STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper multicast Designated Router (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.

DISA Rule

SV-217092r639663_rule

Vulnerability Number

V-217092

Group Title

SRG-NET-000362-RTR-000123

Rule Version

JUNI-RT-000880

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

Configure the multicast router to increase the SPT threshold or set it to infinity to minimalize (S, G) state within the multicast topology where ASM is deployed.

Configure a policy statement to set SPT threshold to infinity for all multicast groups or only specific groups and sources.

[edit policy-options]
set policy-statement SPT_INFINITY term ALL_GROUPS from route-filter 234.0.0.0/8 orlonger
set policy-statement SPT_INFINITY term ALL_GROUPS then accept

Apply the SPT infinity policy.

[edit protocols pim]
set spt-threshold infinity SPT_INFINITY

Check Contents

Review the multicast last-hop router configuration to verify that the SPT switchover threshold is set to infinity for all or specific multicast groups and sources.

Verify that an infinity policy has been enabled for PIM.

protocols {
…
…
…
}
pim {
spt-threshold {
infinity SPT_INFINITY;
}
}
}

Verify that the infinity policy defines specific multicast groups and sources or all multicast groups and sources as shown in the example below.

policy-options {
…
…
…
}
policy-statement SPT_INFINITY {
term ALL_GROUPS {
from {
route-filter 234.0.0.0/8 orlonger;
}
then accept;
}
}
}

If any multicast router is not configured to set the SPT threshold to infinity to minimalize (S, G) state, this is a finding.

Vulnerability Number

V-217092

Documentable

False

Rule Version

JUNI-RT-000880

Severity Override Guidance

Review the multicast last-hop router configuration to verify that the SPT switchover threshold is set to infinity for all or specific multicast groups and sources.

Verify that an infinity policy has been enabled for PIM.

protocols {
…
…
…
}
pim {
spt-threshold {
infinity SPT_INFINITY;
}
}
}

Verify that the infinity policy defines specific multicast groups and sources or all multicast groups and sources as shown in the example below.

policy-options {
…
…
…
}
policy-statement SPT_INFINITY {
term ALL_GROUPS {
from {
route-filter 234.0.0.0/8 orlonger;
}
then accept;
}
}
}

If any multicast router is not configured to set the SPT threshold to infinity to minimalize (S, G) state, this is a finding.

Check Content Reference

M

Target Key

4032

Comments