STIGQter: STIG Summary: Cisco NX-OS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The MPLS switch with RSVP-TE enabled must be configured with message pacing to adjust maximum burst and maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core switches.

DISA Rule

SV-221115r622190_rule

Vulnerability Number

V-221115

Group Title

SRG-NET-000193-RTR-000001

Rule Version

CISC-RT-000610

Severity

CAT III

CCI(s)

• CCI-001095 - The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure the switch to rate limit RSVP messages per interface as shown in the example below. Configure the MPLS switch to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

OSPF Example

SW1(config)# router ospf 1
SW1(config-switch)# mpls ldp sync

IS-IS Example

SW1(config)# router isis
SW1(config-switch)# mpls ldp sync.

SW1(config)# ip rsvp
SW1(config-ip-rsvp)# signaling refresh reduction
SW1(config-ip-rsvp)# end

Check Contents

Review the switch configuration to determine if refresh reduction is enabled.

Step 1: Determine if MPLS TE is enabled on any interface as shown in the example below:

interface Ethernet4/47
mpls traffic-eng tunnels
mpls ip

Step 2: If MPLS TE is enabled, verify that message pacing is enabled.

ip rsvp
signaling refresh reduction bundle-max-size

If the switch with RSVP-TE configured does not have refresh reduction features enabled, this is a finding.

Vulnerability Number

V-221115

Documentable

False

Rule Version

CISC-RT-000610

Severity Override Guidance

Review the switch configuration to determine if refresh reduction is enabled.

Step 1: Determine if MPLS TE is enabled on any interface as shown in the example below:

interface Ethernet4/47
mpls traffic-eng tunnels
mpls ip

Step 2: If MPLS TE is enabled, verify that message pacing is enabled.

ip rsvp
signaling refresh reduction bundle-max-size

If the switch with RSVP-TE configured does not have refresh reduction features enabled, this is a finding.

Check Content Reference

M

Target Key

4075

Comments