The Nokia multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283866 | NOKI-RT-000480 | SV-283866r1203847_rule | CCI-001414 | medium |
| Description | ||||
| PIM is a routing protocol used to build multicast distribution trees for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to interfaces that have PIM enabled. If a PIM neighbor filter is not applied to interfaces that have PIM enabled, unauthorized routers can join the PIM domain, discover and use the rendezvous points, and also advertise their rendezvous points into the domain. This can result in a denial of service by traffic flooding or result in the unauthorized transfer of data. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283866r1203847_chk)
This requirement is not applicable for the DODIN Backbone.
Review the multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.
Verify the IPv4 and IPv6 filter is applied on the PIM-enabled interface using the command below:
- show router interface "TO-PE3" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 50
- show router interface "TO-PE3" detail | match "Ingr IPv6 Flt"
Egr IPv6 Flt : none Ingr IPv6 Flt : 60
If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.
Fix Text (F-88336r1203846_fix)
This requirement is not applicable for the DODIN Backbone.
Configure IPv4 and IPv6 filters to only accept PIM control plane traffic from documented PIM neighbors and apply them to all PIM-enabled interfaces, as shown in the example below:
Configure IPv4 and IPv6 filter:
- configure filter ip-filter 50 create
- config>filter>ip-filter$ entry 10
- config>filter>ip-filter$ entry 10 create
- config>filter>ip-filter>entry$ match protocol "pim"
- config>filter>ip-filter>entry>match$ src-ip 192.100.50.1/30
- config>filter>ip-filter>entry>match$ exit
- config>filter>ip-filter>entry$ action forward
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter$ default-action drop
- config>filter>ip-filter$ exit all
- configure filter ipv6-filter 60
- config>filter>ipv6-filter# entry 10 create
- config>filter>ipv6-filter>entry# match next-header 103
- config>filter>ipv6-filter>entry>match# exit
- config>filter>ipv6-filter>entry# action drop
- config>filter>ipv6-filter>entry# exit all
Apply the IPv4 filter and IPv6 on the interface:
- configure router interface "TO-PE3" ingress filter ip 50
- configure router interface "TO-PE3" ingress filter ipv6 60