STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 10 Release: 7 Benchmark Date: 24 Oct 2024:

Protocol Independent Multicast (PIM) must be disabled on all router interfaces that are not required to support multicast routing.

DISA Rule

SV-251388r806119_rule

Vulnerability Number

V-251388

Group Title

NET2006

Rule Version

NET2006

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

The router administrator will disable PIM on all router interfaces that are not required to support multicast routing.

Check Contents

By default, multicast is disabled globally as well as on all interfaces. Multicast routing is enabled on a router with the global command ip multicast-routing. PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. If the global command ip multicast-routing is defined, review all interface configurations and verify that only the required interfaces are enabled for PIM. The following is a sample configuration with multicast routing enabled and PIM enabled on an interface.

ip multicast-routing
!
interface FastEthernet0/0
ip pim sparse-mode

If PIM is not disabled on interfaces that are not supporting multicast, this is a finding.

Vulnerability Number

V-251388

Documentable

False

Rule Version

NET2006

Severity Override Guidance

By default, multicast is disabled globally as well as on all interfaces. Multicast routing is enabled on a router with the global command ip multicast-routing. PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. If the global command ip multicast-routing is defined, review all interface configurations and verify that only the required interfaces are enabled for PIM. The following is a sample configuration with multicast routing enabled and PIM enabled on an interface.

ip multicast-routing
!
interface FastEthernet0/0
ip pim sparse-mode

If PIM is not disabled on interfaces that are not supporting multicast, this is a finding.

Check Content Reference

M

Target Key

5444