Detections
Analytics

JUEX-RT-000680 - The Juniper multicast RP router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of PIM and MSDP source-active entries.

Information

MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.

Solution

Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries.

set routing-options multicast forwarding-cache threshold suppress <1..200000>
set routing-options multicast forwarding-cache threshold reuse <1..200000>
set routing-options multicast forwarding-cache threshold log-warning <percent to generate warning>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|III, CCI|CCI-002385, CCI|CCI-004866, Rule-ID|SV-254040r997535_rule, STIG-ID|JUEX-RT-000680, Vuln-ID|V-254040

Plugin: Juniper

Control ID: ab938afa3143cb662ae7ea1eb3923bf42287be97ae251d1c72a1d1544b8e6d94