Rule ID
SV-283873r1203868_rule
Version
V1R1
CCIs
MSDP peering with customer network routers presents additional risks to the Defense Information Systems Network (DISN) Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled Rendezvous Point (RP) routers must be configured to only accept MSDP packets from known MSDP peers.
Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers. Verify the filter is applied on the interface using the command below: - show router interface "TO-PE2" detail | match "Ingress Filter" Egress Filter : none Ingress Filter : 10 If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.
Configure MSDP routers to only accept MSDP packets from known MSDP peers, as shown in the example below: Create an IPv4 filter: - configure filter ip-filter 10 create - config>filter>ip-filter# entry 10 - config>filter>ip-filter>entry# match protocol "tcp" - config>filter>ip-filter>entry>match# src-port 639 eq - config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32 - config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32 - config>filter>ip-filter>entry>match# exit - config>filter>ip-filter>entry# action accept - config>filter>ip-filter>entry# exit all Apply the IPv4 filter on the interface: - configure router interface "TO-PE2" ingress filter ip 10