V-283866

Discussion

PIM is a routing protocol used to build multicast distribution trees for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to interfaces that have PIM enabled. If a PIM neighbor filter is not applied to interfaces that have PIM enabled, unauthorized routers can join the PIM domain, discover and use the rendezvous points, and also advertise their rendezvous points into the domain. This can result in a denial of service by traffic flooding or result in the unauthorized transfer of data.

Check Content

This requirement is not applicable for the DODIN Backbone.

Review the multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.

Verify the IPv4 and IPv6 filter is applied on the PIM-enabled interface using the command below:  

- show router interface "TO-PE3" detail | match "Ingress Filter"

Egress Filter    : none                 Ingress Filter    : 50

- show router interface "TO-PE3" detail | match "Ingr IPv6 Flt"

Egr IPv6 Flt     : none                 Ingr IPv6 Flt     : 60

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.