STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX Multicast Source Discovery Protocol router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

DISA Rule

SV-273576r1110885_rule

Vulnerability Number

V-273576

Group Title

SRG-NET-000018-RTR-000008

Rule Version

RCKS-RTR-000080

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Create access list to filter source-active multicast advertisements for any undesirable multicast groups and sources:

ip access-list extended out_MSDP_SA_filter
sequence 10 deny ip 10.0.0.0/8 any
sequence 20 permit ip any any

route-map out_MSDP_SA_filter permit 10
match ip address out_MSDP_SA_filter

router msdp
msdp-peer x.x.x.x
sa-filter originate route-map out_MSDP_SA_filter
!

Check Contents

Check for SA filter on MSDP peer:

ICX# show msdp peer x.x.x.x | include Output 

Output SA Filter:Applicable
Output (S,G) route-map:out_MSDP_SA_filter
Output RP route-map:None

If any configured MSDP peer is not configured to filter outbound advertisements to avoid local-only multicast sources and groups, this is a finding.

Vulnerability Number

V-273576

Documentable

False

Rule Version

RCKS-RTR-000080

Severity Override Guidance

Check for SA filter on MSDP peer:

ICX# show msdp peer x.x.x.x | include Output 

Output SA Filter:Applicable
Output (S,G) route-map:out_MSDP_SA_filter
Output RP route-map:None

If any configured MSDP peer is not configured to filter outbound advertisements to avoid local-only multicast sources and groups, this is a finding.

Check Content Reference

M

Target Key

5696