STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The multicast Rendezvous Point (RP) Arista router must be configured to filter Protocol Independent Multicast (PIM) Register and Join messages received from the Designated Router (DR) for any undesirable multicast groups and sources.

DISA Rule

SV-256007r882363_rule

Vulnerability Number

V-256007

Group Title

SRG-NET-000019-RTR-000013

Rule Version

ARST-RT-000210

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the RP router to filter PIM register and join messages received from a multicast DR for any undesirable multicast groups or sources.

Step 1: Configure an ACL to filter the multicast groups.

LEAF-1A(config)#ip access-list standard ALLOWED_MULTICAST_GROUP
LEAF-1A(config-std-acl-ALLOWED_MULTICAST_GROUP)#10 permit 224.0.0.0/8
LEAF-1A(config-std-acl-ALLOWED_MULTICAST_GROUP)#20 deny any

Step 2: Apply the ACL in the PIM process globally.

LEAF-1A(config)#router pim sparse-mode
LEAF-1A(config-router-pim-sparse)#ipv4
LEAF-1A(config-router-pim-sparse-ipv4)#rp address 100.2.1.6 access-list ALLOWED_MULTICAST_GROUP

Check Contents

Verify that the RP router is configured to filter PIM register and join messages.

Step 1: To verify the ACL is configured to filter the multicast groups, execute the command "show ip access-lists".

ip access-list standard ALLOWED_MULTICAST_GROUP
10 permit 224.0.0.0/8
20 deny any

Step 2: To verify the ACL is applied to the PIM process, execute the command "show run section router pim".

router pim sparse-mode
ipv4
rp address 100.2.1.6 access-list ALLOWED_MULTICAST_GROUP

If the RP router peering with PIM-SM routers is not configured with a PIM import policy to block registration messages for any undesirable multicast groups and sources, this is a finding.

Vulnerability Number

V-256007

Documentable

False

Rule Version

ARST-RT-000210

Severity Override Guidance

Verify that the RP router is configured to filter PIM register and join messages.

Step 1: To verify the ACL is configured to filter the multicast groups, execute the command "show ip access-lists".

ip access-list standard ALLOWED_MULTICAST_GROUP
10 permit 224.0.0.0/8
20 deny any

Step 2: To verify the ACL is applied to the PIM process, execute the command "show run section router pim".

router pim sparse-mode
ipv4
rp address 100.2.1.6 access-list ALLOWED_MULTICAST_GROUP

If the RP router peering with PIM-SM routers is not configured with a PIM import policy to block registration messages for any undesirable multicast groups and sources, this is a finding.

Check Content Reference

M

Target Key

5513