STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.

DISA Rule

SV-283875r1203874_rule

Vulnerability Number

V-283875

Group Title

SRG-NET-000362-RTR-000120

Rule Version

NOKI-RT-000570

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries, as shown in the example below:

Create a prefix-list:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list PIM-JOIN-GROUP
- config>router>policy-options>prefix-list$ prefix 224.0.0.1/32
- config>router>policy-options>prefix-list$ exit

Create a policy statement:

- config>router>policy-options# policy-statement PIM-JOIN-POLICY
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "PIM-JOIN-GROUP"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action accept
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the import register-policy:

- configure router pim import register-policy "PIM-JOIN-POLICY"

Create a dist-cpu-protection policy:

- configure system security dist-cpu-protection
- config>sys>security>dist-cpu-protection# policy "test-dcp" create
- config>sys>security>dist-cpu-protection>policy# static-policer "PIM-RATE-LIMIT" create
- config>sys>security>dist-cpu-protection>policy>static# rate packets 1 within 1
- config>sys>security>dist-cpu-protection>policy>static# exceed-action discard
- config>sys>security>dist-cpu-protection>policy>static# exit
- config>sys>security>dist-cpu-protection>policy# protocol pim create
- config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "PIM-RATE-LIMIT"
- config>sys>security>dist-cpu-protection>policy>protocol# exit all

Apply the dist-cpu-protection policy on the interface:

- configure router interface "TO-PE3" dist-cpu-protection "test-dcp"

Create an IPv4 filter:

- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action drop
- config>filter>ip-filter>entry# exit all

Apply the IPv4 filter on the interface:

- configure router interface "TO-PE2" ingress filter ip 10

Check Contents

Review the router configuration to determine if forwarding cache thresholds are defined.

Verify the dist-cpu-policy applied to the interface using the command below:

- show router interface "TO-PE3" detail | match OperDCpuProtPlcy
OperDCpuProtPlcy : test-dcp

Verify the IPv4 filter is applied on the interface using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10

Verify the Register-Policy is applied using the command below:

- show router pim status | match Policy post-lines 1
Policy

Register Policy : PIM-JOIN-POLICY

If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Vulnerability Number

V-283875

Documentable

False

Rule Version

NOKI-RT-000570

Severity Override Guidance

Review the router configuration to determine if forwarding cache thresholds are defined.

Verify the dist-cpu-policy applied to the interface using the command below:

- show router interface "TO-PE3" detail | match OperDCpuProtPlcy
OperDCpuProtPlcy : test-dcp

Verify the IPv4 filter is applied on the interface using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10

Verify the Register-Policy is applied using the command below:

- show router pim status | match Policy post-lines 1
Policy

Register Policy : PIM-JOIN-POLICY

If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Check Content Reference

M

Target Key

5746