OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper MPLS router with RSVP-TE enabled must be configured to enable refresh reduction features.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-217065JUNI-RT-000590SV-217065r604135_ruleCCI-001095low
Description
RSVP-TE can be used to perform constraint-based routing when building LSP tunnels within the network core that will support QoS and traffic engineering requirements. RSVP-TE is also used to enable MPLS Fast Reroute, a network restoration mechanism that will reroute traffic onto a backup LSP in case of a node or link failure along the primary path. When there is a disruption in the MPLS core, such as a link flap or router reboot, the result is a significant amount of RSVP signaling, such as "PathErr" and "ResvErr" messages that need to be sent for every LSP using that link. When RSVP messages are sent out, they are sent either hop by hop or with the router alert bit set in the IP header. This means that every router along the path must examine the packet to determine if additional processing is required for these RSVP messages. If there is enough signaling traffic in the network, it is possible for an interface to receive more packets for its input queue than it can hold, resulting in dropped RSVP messages and hence slower RSVP convergence. Increasing the size of the interface input queue can help prevent dropping packets; however, there is still the risk of having a burst of signaling traffic that can fill the queue. Solutions to mitigate this risk are RSVP message pacing or refresh reduction to control the rate at which RSVP messages are sent. RSVP refresh reduction includes the following features: RSVP message bundling, RSVP Message ID to reduce message processing overhead, Reliable delivery of RSVP messages using Message ID, and summary refresh to reduce the amount of information transmitted every refresh interval.
STIGDate
Juniper Router RTR Security Technical Implementation Guide2024-12-05

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
CAP-03Capacity Planning
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AU-3Content of Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-001095
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-217065r604135_chk)

Review the router configuration to determine if it is compliant with this requirement. The aggregate reliable commands in the example below will enable the following RSVP refresh reduction features: message bundling, Message ID, reliable message delivery, and summary refresh. protocols { rsvp { interface ge-0/0/0.0 { aggregate; reliable; } } If the router configured with RSVP-TE does not have refresh reduction features enabled, this is a finding.

Fix Text (F-18292r297064_fix)

Configure the router to enable all refresh reduction features as shown in the example. [edit protocols rsvp] set interface ge-0/0/0.0 aggregate reliable Note: The aggregate reliable commands will enable the following RSVP refresh reduction features: message bundling, reliable message delivery, and summary refresh.