The Nokia Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283873 | NOKI-RT-000550 | SV-283873r1203868_rule | CCI-002403 | medium |
| Description | ||||
| MSDP peering with customer network routers presents additional risks to the Defense Information Systems Network (DISN) Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled Rendezvous Point (RP) routers must be configured to only accept MSDP packets from known MSDP peers. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283873r1203868_chk)
Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.
Verify the filter is applied on the interface using the command below:
- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10
If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.
Fix Text (F-88343r1203867_fix)
Configure MSDP routers to only accept MSDP packets from known MSDP peers, as shown in the example below:
Create an IPv4 filter:
- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action accept
- config>filter>ip-filter>entry# exit all
Apply the IPv4 filter on the interface:
- configure router interface "TO-PE2" ingress filter ip 10