The Nokia multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283875 | NOKI-RT-000570 | SV-283875r1203874_rule | CCI-002385 | low |
| Description | ||||
| MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283875r1203874_chk)
Review the router configuration to determine if forwarding cache thresholds are defined.
Verify the dist-cpu-policy applied to the interface using the command below:
- show router interface "TO-PE3" detail | match OperDCpuProtPlcy
OperDCpuProtPlcy : test-dcp
Verify the IPv4 filter is applied on the interface using the command below:
- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10
Verify the Register-Policy is applied using the command below:
- show router pim status | match Policy post-lines 1
Policy
Register Policy : PIM-JOIN-POLICY
If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.
Fix Text (F-88345r1203873_fix)
Configure MSDP-enabled RP routers to limit the multicast forwarding cache for source-active entries, as shown in the example below:
Create a prefix-list:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list PIM-JOIN-GROUP
- config>router>policy-options>prefix-list$ prefix 224.0.0.1/32
- config>router>policy-options>prefix-list$ exit
Create a policy statement:
- config>router>policy-options# policy-statement PIM-JOIN-POLICY
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "PIM-JOIN-GROUP"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action accept
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the import register-policy:
- configure router pim import register-policy "PIM-JOIN-POLICY"
Create a dist-cpu-protection policy:
- configure system security dist-cpu-protection
- config>sys>security>dist-cpu-protection# policy "test-dcp" create
- config>sys>security>dist-cpu-protection>policy# static-policer "PIM-RATE-LIMIT" create
- config>sys>security>dist-cpu-protection>policy>static# rate packets 1 within 1
- config>sys>security>dist-cpu-protection>policy>static# exceed-action discard
- config>sys>security>dist-cpu-protection>policy>static# exit
- config>sys>security>dist-cpu-protection>policy# protocol pim create
- config>sys>security>dist-cpu-protection>policy>protocol# enforcement static "PIM-RATE-LIMIT"
- config>sys>security>dist-cpu-protection>policy>protocol# exit all
Apply the dist-cpu-protection policy on the interface:
- configure router interface "TO-PE3" dist-cpu-protection "test-dcp"
Create an IPv4 filter:
- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action drop
- config>filter>ip-filter>entry# exit all
Apply the IPv4 filter on the interface:
- configure router interface "TO-PE2" ingress filter ip 10