STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 1 hour ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide

V-283687

CAT III (Low)

The Nokia layer 2 switch must have Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping configured on all virtual local area networks (VLANs).

Rule ID

SV-283687r1204134_rule

STIG

Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

IGMP and MLD snooping provides a way to constrain multicast traffic at layer 2. By monitoring the IGMP or MLD membership reports sent by hosts within a VLAN, the snooping application can set up layer 2 multicast forwarding tables to deliver specific multicast traffic only to interfaces connected to hosts interested in receiving the traffic. This significantly reduces the volume of multicast traffic that would otherwise flood the VLAN.

Check Content

Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.

Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping:

- show service id 10 igmp-snooping base

IGMP Snooping Base info for service 10

Admin State : Up
Querier     : No querier found
SBD service : N/A
Evpn-proxy  : Disabled
Port                       Oper MRtr Pim  Send Max  Max  Max   MVR       Num
Id                         Stat Port Port Qrys Grps Srcs Grp   From-VPLS Grps
                                                         Srcs

sap:1/1/c3/10              Up No   No   No   None None None  Local     0

- show service id 10 mld-snooping base

MLD Snooping Base info for service 10

Admin State : Up
Querier     : No querier found
SBD service : N/A
Evpn-proxy  : Disabled

Port                                       Oper MRtr Send Max  MVR       Num
Id                                         Stat Port Qrys Grps From-VPLS Grps

sap:1/1/c3/10                              Up No   No   None Local     0

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Fix Text

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.

The igmp-snooping and mld-snooping can be configured at the VPLS service level or for each access point (VLAN).

For VPLS service-level configuration:

- configure service vpls <service id> igmp-snooping no shutdown
- configure service vpls <service id> mld-snooping no shutdown

For VPLS service access point-level configuration:

- configure service vpls <service id> sap <sap id> igmp-snooping
- configure service vpls <service id> sap <sap id> mld-snooping