Title

The multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries. (Cat III impact)

Discussion

MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.

Check Content

Review the router configuration to determine if forwarding cache thresholds are defined. If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Fix Text

Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries.

Additional Identifiers

Rule ID: SV-207159r856643_rule

Vulnerability ID: V-207159

Group Title: SRG-NET-000362

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.