STIGQter: STIG Summary: RUCKUS ICX Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX multicast Rendezvous Pointerface (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.

DISA Rule

SV-273591r1110892_rule

Vulnerability Number

V-273591

Group Title

SRG-NET-000019-RTR-000014

Rule Version

RCKS-RTR-000230

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Note: Standard ACLs can only be applied to specific RPs. Extended ACLs must be used when applying to any RP.

Configure filter for PIM Join messages and apply to PIM:

ICX(config)#ip access stand FILTER_PIM_JOINS
ICX(config-std-ipacl-FILTER_PIM_JOINS)#deny 239.8.0.0/16
ICX(config-std-ipacl-FILTER_PIM_JOINS)#exit
ICX(config)#router pim
ICX(config-pim-router)#jp-policy 10.1.1.1 FILTER_PIM_JOINS

Check Contents

Check PIM sparse Join/Prune policy configuration for required filters:

ICX# show ip pim jp

Vrf Instance : default-vrf
---------------------------

(RP,G) JP policy
---------

(RP,G) JP policy count: 1

RP-Address ACL Name (RP,G) Join Drops (RP,G) Prune Drops
10.1.1.1 FILTER_PIM_JOINS 0 0

(*,G) and (S,G) JP policy
---------

ACL Name (*,G) Join Drops (*,G) Prune Drops (S,G) Join Drops (S,G) Prune Drops
EXT_FILTER_PIM_JOINS 0 0 0 0

If the RP is not configured to filter PIM register messages, this is a finding.

Vulnerability Number

V-273591

Documentable

False

Rule Version

RCKS-RTR-000230

Severity Override Guidance

Check PIM sparse Join/Prune policy configuration for required filters:

ICX# show ip pim jp

Vrf Instance : default-vrf
---------------------------

(RP,G) JP policy
---------

(RP,G) JP policy count: 1

RP-Address ACL Name (RP,G) Join Drops (RP,G) Prune Drops
10.1.1.1 FILTER_PIM_JOINS 0 0

(*,G) and (S,G) JP policy
---------

ACL Name (*,G) Join Drops (*,G) Prune Drops (S,G) Join Drops (S,G) Prune Drops
EXT_FILTER_PIM_JOINS 0 0 0 0

If the RP is not configured to filter PIM register messages, this is a finding.

Check Content Reference

M

Target Key

5696