The RUCKUS ICX multicast Rendezvous Pointerface (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-273591 | RCKS-RTR-000230 | SV-273591r1110892_rule | CCI-001414 | low |
| Description | ||||
| Real-time multicast traffic can entail multiple large flows of data. An attacker can flood a network segment with multicast packets, over-using the available bandwidth and thereby creating a denial-of-service (DoS) condition. Hence, it is imperative that join messages are only accepted for authorized multicast groups. | ||||
| STIG | Date | |||
| RUCKUS ICX Router Security Technical Implementation Guide | 2025-06-03 | |||
Details
Check Text (C-273591r1110892_chk)
Check PIM sparse Join/Prune policy configuration for required filters:
ICX# show ip pim jp
Vrf Instance : default-vrf
---------------------------
(RP,G) JP policy
---------
(RP,G) JP policy count: 1
RP-Address ACL Name (RP,G) Join Drops (RP,G) Prune Drops
10.1.1.1 FILTER_PIM_JOINS 0 0
(*,G) and (S,G) JP policy
---------
ACL Name (*,G) Join Drops (*,G) Prune Drops (S,G) Join Drops (S,G) Prune Drops
EXT_FILTER_PIM_JOINS 0 0 0 0
If the RP is not configured to filter PIM register messages, this is a finding.
Fix Text (F-77587r1109794_fix)
Note: Standard ACLs can only be applied to specific RPs. Extended ACLs must be used when applying to any RP.
Configure filter for PIM Join messages and apply to PIM:
ICX(config)#ip access stand FILTER_PIM_JOINS
ICX(config-std-ipacl-FILTER_PIM_JOINS)#deny 239.8.0.0/16
ICX(config-std-ipacl-FILTER_PIM_JOINS)#exit
ICX(config)#router pim
ICX(config-pim-router)#jp-policy 10.1.1.1 FILTER_PIM_JOINS