The Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-207170 | SRG-NET-000364-RTR-000116 | SV-207170r856654_rule | CCI-002403 | medium |
| Description | ||||
| MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP routers must be configured to only accept MSDP packets from known MSDP peers. | ||||
| STIG | Date | |||
| Router Security Requirements Guide | 2024-05-28 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (8) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V3R4our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V3R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002403
1.00
- DISA STIG Benchmark (XCCDF)5intersects(normalised)
Details
Check Text (C-207170r856654_chk)
Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.
If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.
Fix Text (F-7431r382539_fix)
Ensure the receive path or interface filter for all MSDP routers only accepts MSDP packets from known MSDP peers.