Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers. [edit firewall] family inet { filter <name> { term 1 { from { source-prefix-list { msdp-peers; } protocol tcp; destination-port msdp; } then accept; } term 2 { from { source-prefix-list { msdp-peers; } protocol tcp; source-port msdp; } then accept; } <additional terms> term default { then { syslog; discard; } } } } family inet6 { filter <name> { term 1 { from { source-prefix-list { msdp-peers-ipv6; } next-header tcp; destination-port msdp; } then accept; } term 2 { from { source-prefix-list { msdp-peers-ipv6; } next-header tcp; source-port msdp; } then accept; } <additional terms> term default { then { syslog; discard; } } } } Note: Some platforms support the "port" keyword that filters on both source- and destination-port, which eliminates the need for separate terms. For instance: filter <name> { term 1 { from { source-prefix-list { <prefix list name>; } [protocol|next-header] tcp; port msdp; } then accept; } <additional terms> term default { then { syslog; discard; } } } Verify the filter is applied to external interfaces or loopback. [edit interfaces] <external interface> { unit <number> { family inet { filter { input <IPv4 filter name>; } address <IPv4 address>/<mask>; } family inet6 { filter { input <IPv6 filter name>; } address <IPv6 address>/<prefix>; } } } lo0 { unit <number> { family inet { filter { input <IPv4 filter name>; } address <IPv4 address>/32; } family inet6 { filter { input <IPv6 filter name>; } address <IPv6 address>/128; } } } Note: Some Juniper devices support both monolithic filters and filter lists. Filter lists separate each term, or set of terms, into a separate filter that is applied sequentially to an interface. If using filter lists, the keywords "input" or "output" change to "input-list" or "output-list". Verify the final list item is a deny-all filter. The deny-all filter is created once per family and can be reused across multiple lists. For example: input-list [ permit_mgt permit_routing_protocols default-deny ]; If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.