STIGQter STIGQter: STIG Summary: Arista MLS EOS 4.X Router Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The multicast Rendezvous Point (RP) Arista router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.

DISA Rule

SV-256037r882453_rule

Vulnerability Number

V-256037

Group Title

SRG-NET-000362-RTR-000120

Rule Version

ARST-RT-000580

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure the Arista MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries.

Step 1: Configure the ACL.

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

Step 2: Apply the ACL in MSDP peer and define the multicast forwarding cache for source-active entries.

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER
sa-limit 500

Check Contents

Review the Arista router configuration to determine if forwarding cache thresholds are defined.

Step 1: To verify the ACL is configured to match the prefixes, execute the command "sh ip access-list".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

Step 2: To verify the thresholds are defined for multicast forwarding cache for source-active entries, execute the command "sh run sec router msdp".

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER
sa-limit 500

If the Arista RP router is not configured to limit the multicast forwarding cache to ensure its resources are not saturated, this is a finding.

Vulnerability Number

V-256037

Documentable

False

Rule Version

ARST-RT-000580

Severity Override Guidance

Review the Arista router configuration to determine if forwarding cache thresholds are defined.

Step 1: To verify the ACL is configured to match the prefixes, execute the command "sh ip access-list".

ip access-list PIM_NEIGHBOR_SA_FILTER
10 deny ip any 224.1.1.0/24
20 deny ip any 224.1.2.0/24
30 deny ip any 224.1.3.0/24
40 deny ip any 224.1.4.0/24
100 permit ip any any

Step 2: To verify the thresholds are defined for multicast forwarding cache for source-active entries, execute the command "sh run sec router msdp".

router msdp
peer 10.1.12.2
sa-filter in PIM_NEIGHBOR_SA_FILTER
sa-limit 500

If the Arista RP router is not configured to limit the multicast forwarding cache to ensure its resources are not saturated, this is a finding.

Check Content Reference

M

Target Key

5513