Detections
Analytics

1.46 CISC-RT-000650

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Cisco PE switch must be configured to have each VRF with the appropriate Route Distinguisher (RD).

GROUP ID: V-221119
RULE ID: SV-221119r999773

An RD provides uniqueness to the customer address spaces within the MPLS L3VPN infrastructure. The concept of the VPN-IPv4 and VPN-IPv6 address families consists of the RD prepended before the IP address. Hence, if the same IP prefix is used in several different L3VPNs, it is possible for BGP to carry several completely different routes for that prefix, one for each VPN.

Since VPN-IPv4 addresses and IPv4 addresses are different address families, BGP never treats them as comparable addresses. The purpose of the RD is to create distinct routes for common IPv4 address prefixes. On any given PE switch, a single RD can define a VRF in which the entire address space may be used independently, regardless of the makeup of other VPN address spaces. Hence, it is imperative that a unique RD is assigned to each L3VPN and that the proper RD is configured for each VRF.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the correct RD for each VRF.

SW1(config)# vrf context CUST1
SW1(config-vrf)# rd 13:13
SW1(config-vrf)# end

See Also

https://workbench.cisecurity.org/benchmarks/22581

Item Details

References: CAT|II, CCI|CCI-004931, CSCv7|13.3, Rule-ID|SV-221119r999773_rule, STIG-ID|CISC-RT-000650, Vuln-ID|V-221119

Plugin: Cisco

Control ID: 2b85fda22887ec2fdbde837507001dc61aee92ec9a9d1d1adf4fd495f6cc6ce9