Detections
Analytics

1.85 CISC-RT-000840

Information

The Cisco multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.

GROUP ID: V-216812RULE ID: SV-216812r531087

Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial-of-service (DoS) condition. Hence, it is imperative that join messages are only accepted for authorized multicast groups.

Solution

Configure the RP to filter PIM join messages for any undesirable multicast groups as shown in the example below.

RP/0/0/CPU0:R2(config)#ipv4 access-list FILTER_PIM_JOINSRP/0/0/CPU0:R2(config-ipv4-acl)#deny 239.8.0.0 0.0.255.255RP/0/0/CPU0:R2(config-ipv4-acl)#permit anyRP/0/0/CPU0:R2(config-ipv4-acl)#exitRP/0/0/CPU0:R2(config)#router pimRP/0/0/CPU0:R2(config-pim)#address-family ipv4RP/0/0/CPU0:R2(config-pim-default-ipv4)#allow-rp group-list FILTER_PIM_JOINSRP/0/0/CPU0:R2(config-pim-default-ipv4)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|III, CCI|CCI-001414, Rule-ID|SV-216812r531087_rule, STIG-ID|CISC-RT-000840, Vuln-ID|V-216812

Plugin: Cisco

Control ID: 8b0dc62766e98509807329771fc0a49c1ff0ef933826ff64154b35ab7ecd5077