← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283875

CAT III (Low)

The Nokia multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.

Rule ID

SV-283875r1203874_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002385

Discussion

MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.

Check Content

Review the router configuration to determine if forwarding cache thresholds are defined.

Verify the dist-cpu-policy applied to the interface using the command below:

- show router interface "TO-PE3" detail | match OperDCpuProtPlcy
OperDCpuProtPlcy : test-dcp

Verify the IPv4 filter is applied on the interface using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter    : none                 Ingress Filter    : 10

Verify the Register-Policy is applied using the command below:

 - show router pim status | match Policy post-lines 1
Policy
   
    Register Policy               : PIM-JOIN-POLICY

If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Fix Text

Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries, as shown in the example below: 

Create a prefix-list:
 
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list PIM-JOIN-GROUP
- config>router>policy-options>prefix-list$ prefix 224.0.0.1/32
- config>router>policy-options>prefix-list$ exit

Create a policy statement: 

- config>router>policy-options# policy-statement PIM-JOIN-POLICY
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "PIM-JOIN-GROUP"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action accept
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the import register-policy:

- configure router pim import register-policy "PIM-JOIN-POLICY"

Create a dist-cpu-protection policy:

- configure system security dist-cpu-protection
- config>sys>security>dist-cpu-protection# policy "test-dcp" create
- config>sys>security>dist-cpu-protection>policy# static-policer "PIM-RATE-LIMIT" create
- config>sys>security>dist-cpu-protection>policy>static# rate packets 1 within 1
- config>sys>security>dist-cpu-protection>policy>static# exceed-action discard
- config>sys>security>dist-cpu-protection>policy>static# exit
- config>sys>security>dist-cpu-protection>policy# protocol pim create
- config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "PIM-RATE-LIMIT"
- config>sys>security>dist-cpu-protection>policy>protocol# exit all

Apply the dist-cpu-protection policy on the interface:

- configure router interface "TO-PE3" dist-cpu-protection "test-dcp"

Create an IPv4 filter:

- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action drop
- config>filter>ip-filter>entry# exit all

Apply the IPv4 filter on the interface:

- configure router interface "TO-PE2" ingress filter ip 10