STIGQter: STIG Summary: Cisco IOS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco multicast edge switch must be configured to establish boundaries for administratively scoped multicast traffic.

DISA Rule

SV-220463r622190_rule

Vulnerability Number

V-220463

Group Title

SRG-NET-000019-RTR-000005

Rule Version

CISC-RT-000810

Severity

CAT III

CCI(s)

CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

Fix Recommendation

Step 1: Configure the ACL to deny packets with multicast administratively scoped destination addresses as shown in the example below:

SW2(config)#ip access-list standard MULTICAST_SCOPE
SW2(config-std-nacl)#deny 239.0.0.0 0.255.255.255
SW2(config-std-nacl)#permit any
SW2(config-std-nacl)#exit

Step 2: Apply the multicast boundary at the appropriate interfaces as shown in the example below:

SW2(config)#int g1/2
SW2(config-if)#ip multicast boundary MULTICAST_SCOPE
SW2(config-if)#end

Check Contents

Review the switch configuration and verify that admin-scope multicast traffic is blocked at the external edge as shown in the example below:

interface GigabitEthernet1/2
no switchport
ip address x.1.12.2 255.255.255.252
ip pim sparse-mode
ip multicast boundary MULTICAST_SCOPE
…
…
…
ip access-list standard MULTICAST_SCOPE
deny 239.0.0.0 0.255.255.255
permit any

If the switch is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.

The Cisco multicast edge switch must be configured to establish boundaries for administratively scoped multicast traffic.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments