STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.

DISA Rule

SV-269892r1052061_rule

Vulnerability Number

V-269892

Group Title

SRG-NET-000362-RTR-000121

Rule Version

OS10-RTR-000710

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the RP to rate limit the number of multicast register messages.

Step 1: Configure a control-plane class map for PIM packets.

OS10(config)# class-map type control-plane PIM-CLASS-MAP
OS10(config-cmap-control-plane)# match pim

Step 2: Configure a control-plane policy map for PIM packets that applies an appropriate rate limit in packets per second.

OS10(config)# policy-map type control-plane PIM-POLICY-MAP
OS10(config-pmap-control-plane)# class PIM-CLASS-MAP
OS10 (config-pmap-c)# set qos-group 2
OS10 (config-pmap-c)# police cir 10 pir 50

Step 3: Assign the service policy to the control plane.

OS10(config)# control-plane
OS10(config-control-plane)# service-policy input PIM-POLICY-MAP

Check Contents

Review the configuration of the RP to verify that it is rate limiting the number of multicast register messages.

Step 1: Verify that a control-plane class map for PIM packets has been configured.

OS10# show running-configuration class-map
!
class-map type control-plane PIM-CLASS-MAP
match pim

Step 2: Verify that a control-plane policy map for PIM packets has been configured that applies an appropriate rate limit in packets per second.

OS10# show running-configuration policy-map
!
policy-map type control-plane PIM-POLICY-MAP
!
class PIM-CLASS-MAP
set qos-group 2
police cir 10 pir 50

Step 3: Verify the service policy has been assigned to the control plane.

OS10# show running-configuration control-plane
!
control-plane
service-policy input PIM-POLICY-MAP

If the RP is not limiting multicast register messages, this is a finding.

Vulnerability Number

V-269892

Documentable

False

Rule Version

OS10-RTR-000710

Severity Override Guidance

Review the configuration of the RP to verify that it is rate limiting the number of multicast register messages.

Step 1: Verify that a control-plane class map for PIM packets has been configured.

OS10# show running-configuration class-map
!
class-map type control-plane PIM-CLASS-MAP
match pim

Step 2: Verify that a control-plane policy map for PIM packets has been configured that applies an appropriate rate limit in packets per second.

OS10# show running-configuration policy-map
!
policy-map type control-plane PIM-POLICY-MAP
!
class PIM-CLASS-MAP
set qos-group 2
police cir 10 pir 50

Step 3: Verify the service policy has been assigned to the control plane.

OS10# show running-configuration control-plane
!
control-plane
service-policy input PIM-POLICY-MAP

If the RP is not limiting multicast register messages, this is a finding.

Check Content Reference

M

Target Key

5668