Detections
Analytics

1.71 CISC-RT-000700

Information

The Cisco PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

GROUP ID: V-216798RULE ID: SV-216798r531087

A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.

Solution

Configure storm control for each CE-facing interface as shown in the example below.

RP/0/0/CPU0:R3(config)#l2vpnRP/0/0/CPU0:R3(config-l2vpn)#bridge group L2GROUPRP/0/0/CPU0:R3(config-l2vpn-bg)# bridge-domain L2_BRIDGE_COI1RP/0/0/CPU0:R3(config-l2vpn-bg-bd)#interface GigabitEthernet0/0/0/2RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control broadcast kbps 1200RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control multicast kbps 1200RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control unknown-unicast kbps 1200RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#end

Note: The acceptable range is 10000000 -1000000000 for a gigabit ethernet interface, and 100000000-10000000000 for a ten gigabit interface. Storm control is not supported on most FastEthernet interfaces.

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|II, CCI|CCI-001095, Rule-ID|SV-216798r531087_rule, STIG-ID|CISC-RT-000700, Vuln-ID|V-216798

Plugin: Cisco

Control ID: 27f03d4e00bb1941c46663199702a232f6ba5f6cc59300a0bc02a413c232ee5d