Detections
Analytics

1.95 CISC-RT-000940

Information

The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to limit the amount of source-active messages it accepts on a per-peer basis.

GROUP ID: V-216822RULE ID: SV-216822r531087

To reduce any risk of a denial-of-service (DoS) attack from a rogue or misconfigured MSDP router, the router must be configured to limit the number of source-active messages it accepts from each peer.

Solution

Configure the router to limit the amount of source-active messages it accepts from each peer.

RP/0/0/CPU0:R2(config)#router msdpRP/0/0/CPU0:R2(config-msdp)#peer x.14.2.1RP/0/0/CPU0:R2(config-msdp-peer)#maximum external-sa nnnRP/0/0/CPU0:R2(config-msdp-peer)#exitRP/0/0/CPU0:R2(config-msdp)#peer x.15.3.5RP/0/0/CPU0:R2(config-msdp-peer)#maximum external-sa nnnRP/0/0/CPU0:R2(config-msdp-peer)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|III, CCI|CCI-001368, Rule-ID|SV-216822r531087_rule, STIG-ID|CISC-RT-000940, Vuln-ID|V-216822

Plugin: Cisco

Control ID: c6b16da62688630fc0382bed6c57ddf9df91229f6342a58d99c4c35b6674a6c6