STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The multicast rendezvous point (RP) Cisco ACI must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the designated router (DR) for any undesirable multicast groups.

DISA Rule

SV-272074r1168396_rule

Vulnerability Number

V-272074

Group Title

SRG-NET-000019-RTR-000014

Rule Version

CACI-RT-000014

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure ACLs on the border leaf switches that act as the PIM DRs, specifically targeting the multicast group addresses to be blocked. This essentially prevents unwanted multicast traffic from entering the fabric by filtering the Join messages at the entry point.

Configure the relevant multicast enabled interfaces by configuring a route map on the PIM settings for the VRF on the GUI. Navigate to Tenants >> {{your_Tenants}} >> Networking >> VRFs >> {{Your_VRF}} >> multicast >> Configuration >> PIM settings >> Reserved Route MAP.

Check Contents

View the configuration to verify PIM compliance.

Configure the relevant multicast enabled interfaces by configuring a route map on the PIM settings for the VRF on the GUI. Navigate to Tenants >> {{your_Tenants}} >> Networking >> VRFs >> {{Your_VRF}} >> multicast >> Configuration >> PIM settings >> Reserved Route MAP.

If the Cisco ACI is not configured to filter join messages received from the DR for any undesirable multicast groups, this is a finding.

Vulnerability Number

V-272074

Documentable

False

Rule Version

CACI-RT-000014

Severity Override Guidance

View the configuration to verify PIM compliance.

Configure the relevant multicast enabled interfaces by configuring a route map on the PIM settings for the VRF on the GUI. Navigate to Tenants >> {{your_Tenants}} >> Networking >> VRFs >> {{Your_VRF}} >> multicast >> Configuration >> PIM settings >> Reserved Route MAP.

If the Cisco ACI is not configured to filter join messages received from the DR for any undesirable multicast groups, this is a finding.

Check Content Reference

M

Target Key

5684