The Nokia multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283864 | NOKI-RT-000460 | SV-283864r1203841_rule | CCI-001414 | low |
| Description | ||||
| Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, overusing the available bandwidth and creating a denial-of-service condition. Hence, it is imperative that join messages are accepted only for authorized multicast groups. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283864r1203841_chk)
Verify the RP router is configured to filter PIM register messages.
Use the command below to verify the join policy:
- show router pim status | match Policy
Policy
Join Policy : PIM-JOIN-POLICY
If the RP router peering with PIM-SM routers is not configured with a PIM import policy to block registration messages for any undesirable multicast groups and sources, this is a finding.
Fix Text (F-88334r1203840_fix)
Configure the RP routers peering with customer PIM-SM routers to implement a PIM import policy to block join messages for reserved and any undesirable multicast groups, as shown in the example below:
Create a prefix-list:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list PIM-JOIN-GROUP
- config>router>policy-options>prefix-list$ prefix 224.0.0.1/32
- config>router>policy-options>prefix-list$ exit
Create a policy statement:
- config>router>policy-options# policy-statement PIM-JOIN-POLICY
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "PIM-JOIN-GROUP"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action accept
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the policy:
- configure router pim import join-policy "PIM-JOIN-POLICY"