Check: JUEX-RT-000680
Juniper EX Series Switches Router STIG:
JUEX-RT-000680
(in versions v1 r3 through v1 r1)
Title
The Juniper multicast RP router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of PIM and MSDP source-active entries. (Cat III impact)
Discussion
MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.
Check Content
Review the router configuration to determine if forwarding cache thresholds are defined. [edit routing-options] multicast { forwarding-cache { threshold { suppress <1..200000>; reuse <1..200000>; log-warning <percent to generate warning>; } } } If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.
Fix Text
Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries. set routing-options multicast forwarding-cache threshold suppress <1..200000> set routing-options multicast forwarding-cache threshold reuse <1..200000> set routing-options multicast forwarding-cache threshold log-warning <percent to generate warning>
Additional Identifiers
Rule ID: SV-254040r844261_rule
Vulnerability ID: V-254040
Group Title: SRG-NET-000362-RTR-000120
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002355 |
The information system enforces access control decisions based on organization-defined security attributes that do not include the identity of the user or process acting on behalf of the user. |
| CCI-002385 |
The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards. |