Title

The RUCKUS ICX multicast Rendezvous Pointerface (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups. (Cat III impact)

Discussion

Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial-of-service (DoS) condition. Hence, it is imperative that join messages are only accepted for authorized multicast groups.

Check Content

Check PIM sparse Join/Prune policy configuration for required filters: ICX# show ip pim jp Vrf Instance : default-vrf --------------------------- (RP,G) JP policy --------- (RP,G) JP policy count: 1 RP-Address ACL Name (RP,G) Join Drops (RP,G) Prune Drops 10.1.1.1 FILTER_PIM_JOINS 0 0 (*,G) and (S,G) JP policy --------- ACL Name (*,G) Join Drops (*,G) Prune Drops (S,G) Join Drops (S,G) Prune Drops EXT_FILTER_PIM_JOINS 0 0 0 0 If the RP is not configured to filter PIM register messages, this is a finding.

Fix Text

Note: Standard ACLs can only be applied to specific RPs. Extended ACLs must be used when applying to any RP. Configure filter for PIM Join messages and apply to PIM: ICX(config)#ip access stand FILTER_PIM_JOINS ICX(config-std-ipacl-FILTER_PIM_JOINS)#deny 239.8.0.0/16 ICX(config-std-ipacl-FILTER_PIM_JOINS)#exit ICX(config)#router pim ICX(config-pim-router)#jp-policy 10.1.1.1 FILTER_PIM_JOINS

Additional Identifiers

Rule ID: SV-273591r1110892_rule

Vulnerability ID: V-273591

Group Title: SRG-NET-000019-RTR-000014

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.