OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco PE router providing Virtual Private LAN Services (VPLS) must be configured to have traffic storm control thresholds on CE-facing interfaces.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-216798CISC-RT-000700SV-216798r531087_ruleCCI-001095medium
Description
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.
STIGDate
Cisco IOS XR Router RTR Security Technical Implementation Guide2025-08-19

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
CAP-03Capacity Planning
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AU-3Content of Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-001095
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-216798r531087_chk)

Review the router configuration to verify that storm control is enabled on CE-facing interfaces deploying VPLS as shown in the example below. bridge group L2GROUP bridge-domain L2_BRIDGE_COI1 interface GigabitEthernet0/0/0/2 storm-control unknown-unicast kbps 1200 storm-control multicast kbps 1200 storm-control broadcast kbps 1200 split-horizon group ! If storm control is not enabled at a minimum for broadcast traffic, this is a finding.

Fix Text (F-18028r288772_fix)

Configure storm control for each CE-facing interface as shown in the example below. RP/0/0/CPU0:R3(config)#l2vpn RP/0/0/CPU0:R3(config-l2vpn)#bridge group L2GROUP RP/0/0/CPU0:R3(config-l2vpn-bg)# bridge-domain L2_BRIDGE_COI1 RP/0/0/CPU0:R3(config-l2vpn-bg-bd)#interface GigabitEthernet0/0/0/2 RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control broadcast kbps 1200 RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control multicast kbps 1200 RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#storm-control unknown-unicast kbps 1200 RP/0/0/CPU0:R3(config-l2vpn-bg-bd-ac)#end Note: The acceptable range is 10000000 -1000000000 for a gigabit ethernet interface, and 100000000-10000000000 for a ten gigabit interface. Storm control is not supported on most FastEthernet interfaces.