Detections
Analytics

1.73 CISC-RT-000940

Information

The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to limit the amount of source-active messages it accepts on a per-peer basis.

GROUP ID: V-221146
RULE ID: SV-221146r999755

To reduce any risk of a denial-of-service (DoS) attack from a rogue or misconfigured MSDP switch, the switch must be configured to limit the number of source-active messages it accepts from each peer.

Solution

Configure the switch to limit the amount of source-active messages it accepts from each peer.

SW1(config)# ip msdp sa-limit x.1.28.2 nnn
SW1(config)# end

See Also

https://workbench.cisecurity.org/benchmarks/26426

Item Details

Category: ACCESS CONTROL, SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-4, 800-53|CA-7, 800-53|SC-4, CCI|CCI-001368, CSCv7|13.3, Rule-ID|SV-221146r999755_rule, STIG-ID|CISC-RT-000940, Vuln-ID|V-221146

Plugin: Cisco

Control ID: dd09b29f0594924818bd6d2330b6c15471f2e70fa6c7eef956fe8161362a0af9