Check: NET2017
Network Infrastructure Policy STIG:
NET2017
(in versions v10 r6 through v9 r5)
Title
First-hop redundancy services must be configured to delay any preempt to provide enough time for the Internet Gateway Protocol (IGP) to stabilize. (Cat III impact)
Discussion
The Layer 2 connection between the nodes providing first-hop redundancy comes up quickly. If the preemption takes effect prior to the routing protocol converging, traffic is black holed. Traffic will go to the active router that does not have full routing information. It may take several seconds for the IGP to exchange all the routes, longer than the Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), or Gateway Load Balancing Protocol (GLPB) transition. The recommended practice is to delay the preemption action until after the IGP has a chance to stabilize.
Check Content
All routers or multilayer switches providing first-hop redundancy services must be configured to delay preemption to provide enough time for the IGP to stabilize. Review the router or multilayer switch providing first-hop redundancy services and verify that the preemption delay is configured. If preemption delay is not configured, this is a finding. Following is an HSRP configuration example that delays the preemption by 30 seconds. interface GigabitEthernet 0/0/0 ip address 10.11.0.2 255.255.255.0 standby 1 priority 110 standby 1 ip 10.21.0.1 standby 1 preempt standby 1 preempt delay minimum 30 Following is a VRRP configuration example that delays the preemption by 30 seconds. interface GigabitEthernet 0/0/0 ip address 10.11.0.2 255.255.255.0 vrrp 1 priority 110 vrrp 1 ip 10.21.0.1 vrrp 1 preempt delay minimum 30 For VRRP implementations, a preemptive scheme is enabled by default. If preemption is disabled using the no vrrp preempt command, the virtual router backup that is elected to become virtual router master remains the master until the original virtual router master recovers and becomes master again.
Fix Text
Configure each router and multilayer switch providing first-hop redundancy services to be configured to delay the preempt to provide enough time for the IGP to stabilize. Note: The amount of delay will be based on the number of IGP routes.
Additional Identifiers
Rule ID: SV-251399r806152_rule
Vulnerability ID: V-251399
Group Title: NET2017
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |