STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper multicast Designated Router (DR) must be configured to increase the shortest-path tree (SPT) threshold or set it to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.

DISA Rule

SV-254043r945856_rule

Vulnerability Number

V-254043

Group Title

SRG-NET-000362-RTR-000123

Rule Version

JUEX-RT-000710

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the multicast router to increase the SPT threshold or set it to infinity to minimalize (S, G) state within the multicast topology where ASM is deployed.

set policy-options policy-statement <name> term 1 from route-filter 239.0.0.0/8 orlonger
set policy-options policy-statement <name> term 1 then accept

set protocols pim spt-threshold infinity <policy name>

Check Contents

Review the multicast last-hop router configuration to verify that the SPT switchover threshold is increased (default is "0") or set to infinity (never switch over).

Verify the policy statement includes specific multicast groups or all groups (as shown).
[edit policy-options]
policy-statement <name> {
term 1 {
from {
route-filter 234.0.0.0/8 orlonger;
}
then accept;
}
}

Verify the infinity policy is applied.
[edit protocols pim]
spt-threshold {
infinity <policy name>;
}

If any multicast router is not configured to increase the SPT threshold or set to infinity to minimalize (S, G) state, this is a finding.

Vulnerability Number

V-254043

Documentable

False

Rule Version

JUEX-RT-000710

Severity Override Guidance

Review the multicast last-hop router configuration to verify that the SPT switchover threshold is increased (default is "0") or set to infinity (never switch over).

Verify the policy statement includes specific multicast groups or all groups (as shown).
[edit policy-options]
policy-statement <name> {
term 1 {
from {
route-filter 234.0.0.0/8 orlonger;
}
then accept;
}
}

Verify the infinity policy is applied.
[edit protocols pim]
spt-threshold {
infinity <policy name>;
}

If any multicast router is not configured to increase the SPT threshold or set to infinity to minimalize (S, G) state, this is a finding.

Check Content Reference

M

Target Key

5479