STIGQter STIGQter: STIG Summary: Cisco NX-OS Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Cisco multicast Designated switch (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.

DISA Rule

SV-221141r648772_rule

Vulnerability Number

V-221141

Group Title

SRG-NET-000362-RTR-000123

Rule Version

CISC-RT-000890

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the DR to increase the SPT threshold or set it to infinity to minimalize (S, G) state within the multicast topology where ASM is deployed.

Step 1: Configure a prefix list or route map to specify the ASM groups. The example below includes all global ASM groups.

SW1(config)# ip prefix-list SPT_GROUPS permit 233.0.0.0/8

Step 2. Configure the SPT threshold to infinity.

SW1(config)# ip pim spt-threshold infinity group prefix-list SPT_GROUPS
SW1(config)# end

Check Contents

Review the DR configuration to verify that the SPT switchover threshold is set to infinity (never switch over).

ip pim spt-threshold infinity group-list prefix-list SPT_GROUPS

Note: The default behavior is to join the SPT immediately upon the first data packet it receives.

If the DR is not configured set SPT threshold to infinity to minimalize (S, G) state, this is a finding.

Vulnerability Number

V-221141

Documentable

False

Rule Version

CISC-RT-000890

Severity Override Guidance

Review the DR configuration to verify that the SPT switchover threshold is set to infinity (never switch over).

ip pim spt-threshold infinity group-list prefix-list SPT_GROUPS

Note: The default behavior is to join the SPT immediately upon the first data packet it receives.

If the DR is not configured set SPT threshold to infinity to minimalize (S, G) state, this is a finding.

Check Content Reference

M

Target Key

4075

Comments