Details

The administrator must ensure that a PIM neighbor filter is bound to all interfaces that have PIM enabled.

Protocol Independent Multicast (PIM) is a routing protocol used to build multicast distribution tress for forwarding multicast traffic across the network infrastructure. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.

NOTE: Change ‘IPV6_PIM_NEIGHBORS_ACL’ to the IPv6 access-list used for filtering authorized PIM neighbors.

Solution

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM has a neighbor filter to only accept PIM control plane traffic from the documented routers according to the multicast topology diagram.

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_Network_Infrastructure_Router_L3_Switch_V8R29_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.

References

• 800-53|SC-7(11)
• CAT|II
• Rule-ID|SV-40315r1_rule
• STIG-ID|NET-MCAST-002
• Vuln-ID|V-30578

Source

• Tenable.com/audits