The Cisco Multicast Source Discovery Protocol (MSDP) switch must be configured to only accept MSDP packets from known MSDP peers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-221142 | CISC-RT-000900 | SV-221142r999751_rule | CCI-002403 | medium |
| Description | ||||
| MSDP peering with customer network switches presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled switch. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP switches must be configured to only accept MSDP packets from known MSDP peers. | ||||
| STIG | Date | |||
| Cisco NX OS Switch RTR Security Technical Implementation Guide | 2024-12-20 | |||
Details
Check Text (C-221142r999751_chk)
Review the switch configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.
Step 1: Verify that interfaces used for MSDP peering have an inbound ACL as shown in the example below:
interface Ethernet2/3
no switchport
ip access-group EXTERNAL_ACL_INBOUND in
ip address x.1.28.8/24
ip pim sparse-mode
Step 2: Verify that the ACL restricts MSDP peering to only known sources.
ip access-list EXTERNAL_ACL_INBOUND
10 permit tcp any any established
20 permit tcp x.1.28.2/32 x.1.28.8/32 eq 639
30 deny tcp any x.1.28.8/32 eq 639 log
40 permit tcp x.1.28.2/32 10.x.28.8/32 eq bgp
50 permit tcp x.1.28.2/32 eq bgp x.1.28.8/32
60 permit pim x.1.28.2/32 x.1.28.8/32
…
…
…
120 deny ip any any log
Note: MSDP connections are via TCP port 639.
If the switch is not configured to only accept MSDP packets from known MSDP peers, this is a finding.
Fix Text (F-22846r409916_fix)
Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.
SW1(config)# ip access-list EXTERNAL_ACL_INBOUND
SW1(config-acl) # permit tcp any any established
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq 639
SW1(config-acl) # deny tcp any host x1.28.8 eq 639
SW1(config-acl) # permit tcp host x.1.28.2 host x.1.28.8 eq bgp
SW1(config-acl) # permit tcp host x.1.28.2 eq bgp host x.1.28.8
SW1(config-acl) # permit pim host x.1.28.2 host x.1.28.8
…
…
…
SW1(config-acl)# deny ip any any