Title

The multicast rendezvous point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages. (Cat II impact)

Discussion

When a new source starts transmitting in a PIM Sparse Mode network, the designated router (DR) will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

Check Content

Review the configuration of the RP to verify that it is rate limiting the number of PIM register messages: tenant <tenant-name> vrf <vrf-name> ip pim register rate limit 10 If the RP is not limiting PIM register messages, this is a finding.

Fix Text

Configure the RP to rate limit the number of multicast register messages: apic(config)# tenant <tenant-name> apic(config)# vrf <vrf-name> apic(config)# ip pim register rate limit 10

Additional Identifiers

Rule ID: SV-272091r1064599_rule

Vulnerability ID: V-272091

Group Title: SRG-NET-000362-RTR-000121

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.