Detections
Analytics
CISC-RT-000900 - The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to only accept MSDP packets from known MSDP peers.
Information
MSDP peering with customer network switches presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled switch. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP switches must be configured to only accept MSDP packets from known MSDP peers.NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.SW1(config)# ip access-list EXTERNAL_ACL_INBOUND
SW1(config-acl) # permit tcp any any established
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq 639
SW1(config-acl) # deny tcp any host x1.28.8 eq 639
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq bgp
SW1(config-acl) # permit tcp host x.1.28.2 eq bgp host x.1.28.8
SW1(config-acl) # permit pim host x.1.28.2 host x.1.28.8
...
...
...
SW1(config-acl)# deny ip any any
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_NX-OS_Switch_Y26M01_STIG.zip
Item Details
Audit Name: DISA Cisco NX OS Switch RTR STIG v3r3
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7(11), CAT|II, CCI|CCI-002403, Rule-ID|SV-221142r999751_rule, STIG-ID|CISC-RT-000900, STIG-Legacy|SV-111177, STIG-Legacy|V-102221, Vuln-ID|V-221142
Plugin: Cisco
Control ID: c353e51f2f6c7b67b109dc41d0a45138679c6a4dd9484e952acaaa806af8a5cf