The Nokia Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283835 | NOKI-RT-000170 | SV-283835r1203754_rule | CCI-001368 | low |
| Description | ||||
| To avoid global visibility of local information, a number of source-group (S, G) states in a Protocol Independent Multicast - Sparse Mode (PIM-SM) domain must not be leaked to another domain, such as multicast sources with private address, administratively scoped multicast addresses, and the Automatic Rendezvous Point (auto-RP) groups (224.0.1.39 and 224.0.1.40). Allowing a multicast distribution tree, local to the core, to extend beyond its boundary could enable local multicast traffic to leak into other autonomous systems and customer networks. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283835r1203754_chk)
Review the Nokia router configuration to determine if there is export policy to block local source-active multicast advertisements.
Verify the export policy, as shown in the example below:
- show router msdp peer 1.1.1.1 detail | match "Export Policy"
Export Policy : MSDP-EXPORT-SA
If the router is not configured with an export policy to filter local source-active multicast advertisements, this is a finding.
Fix Text (F-88305r1203753_fix)
Ensure an export policy is implemented on all MSDP routers to avoid global visibility of local multicast (S, G) states. Create an export policy.
Configure prefix-list, as shown in the example below:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Multicast-Group-Source"
- config>router>policy-options>prefix-list# prefix 233.0.0.0/8 exact
- config>router>policy-options>prefix-list# prefix 172.200.200.2/32 exact
- config>router>policy-options>prefix-list# exit
Configure policy, as shown in the example below:
- config>router>policy-options# policy-statement "MSDP-EXPORT-SA"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Multicast-Group-Source"
- config>router>policy-options>policy-statement>entry# action drop
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# default-action accept
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the export policy to the MSDP peer:
- configure router msdp peer 1.1.1.1 export "MSDP-EXPORT-SA"