The Nokia Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283873 | NOKI-RT-000550 | SV-283873r1203868_rule | CCI-002403 | medium |
| Description | ||||
| MSDP peering with customer network routers presents additional risks to the Defense Information Systems Network (DISN) Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled Rendezvous Point (RP) routers must be configured to only accept MSDP packets from known MSDP peers. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (8) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V3R4our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002403
1.00
- DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
Details
Check Text (C-283873r1203868_chk)
Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.
Verify the filter is applied on the interface using the command below:
- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10
If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.
Fix Text (F-88343r1203867_fix)
Configure MSDP routers to only accept MSDP packets from known MSDP peers, as shown in the example below:
Create an IPv4 filter:
- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action accept
- config>filter>ip-filter>entry# exit all
Apply the IPv4 filter on the interface:
- configure router interface "TO-PE2" ingress filter ip 10