STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 1 hour ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283822

CAT II (Medium)

The multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) register messages.

Rule ID

SV-283822r1204021_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002385

Discussion

When a new source starts transmitting in a PIM Sparse Mode network, the Designated Router will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the Designated Router and the RP if the source is running at a high data rate and many new sources are starting at the same time. This scenario could occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

Check Content

Review the configuration of the RP to verify it is rate limiting the number of multicast register messages.

Verify the CPU-protection policy has been configured on the interface, as shown in the example below: 

- show router interface "TO-PE3" detail | match OperDCpuProtPlcy

OperDCpuProtPlcy : test-dcp

Verify if the policer state and exceed count:

- show router interface "TO-PE3" dist-cpu-protection detail

-------------------------------------------------------------------------------
Statistics/Policer-State Information

-------------------------------------------------------------------------------
Static Policer
-------------------------------------------------------------------------------
Policer-Name        : PIM-RATE-LIMIT
Card/FP             : 1/1               Policer-State       : Conform
Protocols Mapped    : pim
Exceed-Count        : 0
Total Exceed-Count  : 0                 Exceed-State-Count  : 0
Detec. Time Remain  : 0 seconds         Hold-Down Remain.   : none
Operational (adapted) Rate Parameters:
 Oper. Packets      : 1 ppi              Oper. Within       : 1 seconds
 Oper. Initial Delay: none
 Oper. Depth        : 0 packets

If the RP is not limiting multicast register messages, this is a finding.

Fix Text

Configure the RP to rate limit the number of multicast register messages, as shown in the example below: 

Note: Limit may be set by packet-per-second or kilobit-per-second.

- configure system security dist-cpu-protection
- config>sys>security>dist-cpu-protection# policy "test-dcp"
- config>sys>security>dist-cpu-protection>policy# static-policer "PIM-RATE-LIMIT" create
- config>sys>security>dist-cpu-protection>policy>static# rate packets 1 within 1
- config>sys>security>dist-cpu-protection>policy>static# exceed-action discard
- config>sys>security>dist-cpu-protection>policy>static# exit
- config>sys>security>dist-cpu-protection>policy# protocol pim
- config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "PIM-RATE-LIMIT"
- config>sys>security>dist-cpu-protection>policy>protocol# exit all

- configure router interface "TO-PE3" dist-cpu-protection "test-dcp"