The Nokia layer 2 switch must have Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping configured on all virtual local area networks (VLANs).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283687 | NOKI-L2-000150 | SV-283687r1204134_rule | CCI-000366 | low |
| Description | ||||
| IGMP and MLD snooping provides a way to constrain multicast traffic at layer 2. By monitoring the IGMP or MLD membership reports sent by hosts within a VLAN, the snooping application can set up layer 2 multicast forwarding tables to deliver specific multicast traffic only to interfaces connected to hosts interested in receiving the traffic. This significantly reduces the volume of multicast traffic that would otherwise flood the VLAN. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283687r1204134_chk)
Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.
Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping:
- show service id 10 igmp-snooping base
IGMP Snooping Base info for service 10
Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled
Port Oper MRtr Pim Send Max Max Max MVR Num
Id Stat Port Port Qrys Grps Srcs Grp From-VPLS Grps
Srcs
sap:1/1/c3/10 Up No No No None None None Local 0
- show service id 10 mld-snooping base
MLD Snooping Base info for service 10
Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled
Port Oper MRtr Send Max MVR Num
Id Stat Port Qrys Grps From-VPLS Grps
sap:1/1/c3/10 Up No No None Local 0
If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.
Fix Text (F-88157r1204088_fix)
Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.
The igmp-snooping and mld-snooping can be configured at the VPLS service level or for each access point (VLAN).
For VPLS service-level configuration:
- configure service vpls <service id> igmp-snooping no shutdown
- configure service vpls <service id> mld-snooping no shutdown
For VPLS service access point-level configuration:
- configure service vpls <service id> sap <sap id> igmp-snooping
- configure service vpls <service id> sap <sap id> mld-snooping