The Nokia multicast router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283889 | NOKI-RT-000740 | SV-283889r1223373_rule | CCI-001414 | medium |
| Description | ||||
| If multicast traffic is forwarded beyond the intended boundary, it could be intercepted by unauthorized or unintended personnel. Limiting where within the network a given multicast group's data is permitted to flow is an important first step in improving multicast security. A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap, while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"; that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoW IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Therefore, it is imperative that the network engineers have documented their multicast topology and know which interfaces are enabled for multicast. Once this is done, the zones can be scoped as required. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283889r1223373_chk)
If IPv4 or IPv6 multicast routing is enabled, verify all interfaces enabled for PIM are documented in the network's multicast topology diagram.
Determine if the PIM interface is disabled using the command below:
- show router pim interface "TO-PE1"
PIM Interface ipv4 TO-PE1
Interface Adm Opr DR Prty Hello Intvl Mcast Send
DR
-------------------------------------------------------------------------------
TO-PE1 Down Down N/A 30 auto
N/A
-------------------------------------------------------------------------------
Interfaces : 1
If an interface is not required to support multicast routing and is enabled, this is a finding.
Fix Text (F-88359r1203915_fix)
Document all enabled interfaces for PIM in the network's multicast topology diagram. Disable support for PIM on interfaces that are not required to support it.
Configure the multicast router to disable the PIM interface using the example below:
- configure router pim interface "TO-PE1" shutdown