STIGQter: STIG Summary: Cisco IOS XR Router RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco MPLS router must be configured to synchronize IGP and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

DISA Rule

SV-216788r531087_rule

Vulnerability Number

V-216788

Group Title

SRG-NET-000512-RTR-000003

Rule Version

CISC-RT-000600

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

OSPF Example

RP/0/0/CPU0:R3(config)#router ospf 1
RP/0/0/CPU0:R3(config-ospf)#mpls ldp sync
RP/0/0/CPU0:R3(config-ospf)#end

IS-IS Example

RP/0/0/CPU0:R3(config)#router isis 1
RP/0/0/CPU0:R3(config-isis)#interface g0/0/0/1
RP/0/0/CPU0:R3(config-isis-if)#address-family ipv4 unicast
RP/0/0/CPU0:R3(config-isis-if-af)#mpls ldp sync
RP/0/0/CPU0:R3(config-isis-if-af)#end

Check Contents

OSPF Example

router ospf 1
mpls ldp sync

IS-IS Example

router isis 1
net 49.0001.1234.1600.5531.00
interface GigabitEthernet0/0/0/1
address-family ipv4 unicast
mpls ldp sync

If the router is not configured to synchronize IGP and LDP, this is a finding.

Vulnerability Number

V-216788

Documentable

False

Rule Version

CISC-RT-000600

Severity Override Guidance

OSPF Example

router ospf 1
mpls ldp sync

IS-IS Example

router isis 1
net 49.0001.1234.1600.5531.00
interface GigabitEthernet0/0/0/1
address-family ipv4 unicast
mpls ldp sync

If the router is not configured to synchronize IGP and LDP, this is a finding.

Check Content Reference

M

Target Key

4029

Comments