STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper multicast RP router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of PIM and MSDP source-active entries.

DISA Rule

SV-254040r997535_rule

Vulnerability Number

V-254040

Group Title

SRG-NET-000362-RTR-000120

Rule Version

JUEX-RT-000680

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-004866 - Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.

Weight

10

Fix Recommendation

Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries.

set routing-options multicast forwarding-cache threshold suppress <1..200000>
set routing-options multicast forwarding-cache threshold reuse <1..200000>
set routing-options multicast forwarding-cache threshold log-warning <percent to generate warning>

Check Contents

Review the router configuration to determine if forwarding cache thresholds are defined.

[edit routing-options]
multicast {
forwarding-cache {
threshold {
suppress <1..200000>;
reuse <1..200000>;
log-warning <percent to generate warning>;
}
}
}

If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Vulnerability Number

V-254040

Documentable

False

Rule Version

JUEX-RT-000680

Severity Override Guidance

Review the router configuration to determine if forwarding cache thresholds are defined.

[edit routing-options]
multicast {
forwarding-cache {
threshold {
suppress <1..200000>;
reuse <1..200000>;
log-warning <percent to generate warning>;
}
}
}

If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Check Content Reference

M

Target Key

5479