Check: CISC-RT-000600
Cisco IOS XR Router RTR STIG:
CISC-RT-000600
(in versions v2 r4 through v1 r0.1)
Title
The Cisco MPLS router must be configured to synchronize IGP and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange. (Cat III impact)
Discussion
Packet loss can occur when an IGP adjacency is established and the router begins forwarding packets using the new adjacency before the LDP label exchange completes between the peers on that link. Packet loss can also occur if an LDP session closes and the router continues to forward traffic using the link associated with the LDP peer rather than an alternate pathway with a fully synchronized LDP session. The MPLS LDP-IGP Synchronization feature provides a means to synchronize LDP with OSPF or IS-IS to minimize MPLS packet loss. When an IGP adjacency is established on a link but LDP-IGP synchronization is not yet achieved or is lost, the IGP will advertise the max-metric on that link.
Check Content
OSPF Example router ospf 1 mpls ldp sync IS-IS Example router isis 1 net 49.0001.1234.1600.5531.00 interface GigabitEthernet0/0/0/1 address-family ipv4 unicast mpls ldp sync If the router is not configured to synchronize IGP and LDP, this is a finding.
Fix Text
Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange. OSPF Example RP/0/0/CPU0:R3(config)#router ospf 1 RP/0/0/CPU0:R3(config-ospf)#mpls ldp sync RP/0/0/CPU0:R3(config-ospf)#end IS-IS Example RP/0/0/CPU0:R3(config)#router isis 1 RP/0/0/CPU0:R3(config-isis)#interface g0/0/0/1 RP/0/0/CPU0:R3(config-isis-if)#address-family ipv4 unicast RP/0/0/CPU0:R3(config-isis-if-af)#mpls ldp sync RP/0/0/CPU0:R3(config-isis-if-af)#end
Additional Identifiers
Rule ID: SV-216788r531087_rule
Vulnerability ID: V-216788
Group Title: SRG-NET-000512-RTR-000003
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |