STIGQter: STIG Summary: HP FlexFabric Switch RTR Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

The HP FlexFabric Switch must bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

DISA Rule

SV-80627r1_rule

Vulnerability Number

V-66137

Group Title

SRG-NET-000019-RTR-000004

Rule Version

HFFS-RT-000025

Severity

CAT II

CCI(s)

• CCI-001414 - The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure neighbor filters to only accept PIM control plane traffic from documented PIM neighbors. Bind neighbor filters to all PIM enabled interfaces using the example bellow.

acl basic 2000
rule 0 permit source 224.200.100.10 0
rule 5 permit source 224.200.101.11 0
rule 10 deny source any

interface GigabitEthernet0/1
pim neighbor-policy 2000

Check Contents

Review the multicast topology diagram and determine if the HP FlexFabric Switch interfaces are enabled for IPv4 or IPv6 multicast routing.

If the HP FlexFabric Switch is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors.

If a PIM neighbor filter is not configured on all multicast-enabled interfaces, this is a finding.

display interface GigabitEthernet 0/1

interface GigabitEthernet0/1
port link-mode route
description IUT 4GE-HMIM
ip address 15.252.78.69 255.255.255.0
pim sm
pim neighbor-policy 2000
ipv6 pim sm
ipv6 pim neighbor-policy 2000

[HP]display acl 2000
Basic ACL 2000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit source 224.200.100.10 0
rule 5 permit source 224.200.101.11 0
rule 10 deny

Vulnerability Number

V-66137

Documentable

False

Rule Version

HFFS-RT-000025

Severity Override Guidance

Review the multicast topology diagram and determine if the HP FlexFabric Switch interfaces are enabled for IPv4 or IPv6 multicast routing.

If the HP FlexFabric Switch is enabled for multicast routing, verify all interfaces enabled for PIM have a neighbor filter bound to the interface. The neighbor filter must only accept PIM control plane traffic from the documented PIM neighbors.

If a PIM neighbor filter is not configured on all multicast-enabled interfaces, this is a finding.

display interface GigabitEthernet 0/1

interface GigabitEthernet0/1
port link-mode route
description IUT 4GE-HMIM
ip address 15.252.78.69 255.255.255.0
pim sm
pim neighbor-policy 2000
ipv6 pim sm
ipv6 pim neighbor-policy 2000

[HP]display acl 2000
Basic ACL 2000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit source 224.200.100.10 0
rule 5 permit source 224.200.101.11 0
rule 10 deny

Check Content Reference

M

Target Key

2979

Comments