Detections
Analytics

1.69 CISC-RT-000900

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to only accept MSDP packets from known MSDP peers.

GROUP ID: V-221142
RULE ID: SV-221142r999751

MSDP peering with customer network switches presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled switch. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP switches must be configured to only accept MSDP packets from known MSDP peers.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.

SW1(config)# ip access-list EXTERNAL_ACL_INBOUND
SW1(config-acl) # permit tcp any any established
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq 639
SW1(config-acl) # deny tcp any host x1.28.8 eq 639
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq bgp
SW1(config-acl) # permit tcp host x.1.28.2 eq bgp host x.1.28.8
SW1(config-acl) # permit pim host x.1.28.2 host x.1.28.8
...
...
...
SW1(config-acl)# deny ip any any

See Also

https://workbench.cisecurity.org/benchmarks/22581

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(11), CAT|II, CCI|CCI-002403, CSCv7|14.6, Rule-ID|SV-221142r999751_rule, STIG-ID|CISC-RT-000900, Vuln-ID|V-221142

Plugin: Cisco

Control ID: ffa0361fe4405bec15a6131c33a588e9a8b329da572b18e46b4e261356f67af8