STIGQter: STIG Summary: Juniper Router RTR Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 12 Feb 2021:

The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

DISA Rule

SV-217096r639663_rule

Vulnerability Number

V-217096

Group Title

SRG-NET-000018-RTR-000008

Rule Version

JUNI-RT-000920

Severity

CAT III

CCI(s)

• CCI-001368 - The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router with an export policy avoid global visibility of local multicast (S, G) states. The example below will avoid exporting multicast active sources belonging to the private network.

[edit policy-options]
set policy-statement SA_EXPORT term INTERNAL_GROUP from route-filter 239.0.0.0/8 orlonger
set policy-statement SA_EXPORT term INTERNAL_GROUP then reject
set policy-statement SA_EXPORT term INTERNAL_ADDR from source-address-filter 10.0.0.0/8 orlonger
set policy-statement SA_EXPORT term INTERNAL_ADDR then reject
set policy-statement SA_EXPORT term ACCEPT_OTHERS then accept

[edit protocols msdp]
set export SA_EXPORT

Check Contents

Review the router configuration to determine if there is export policy to block local source-active multicast advertisements.

Verify that the router is configured with an export policy to filter multicast source-active advertisements.

policy-options {
…
…
…
}
policy-statement SA_EXPORT {
term INTERNAL_GROUP {
from {
route-filter 239.0.0.0/8 orlonger;
}
then reject;
}
term INTERNAL_ADDR {
from {
source-address-filter 10.0.0.0/8 orlonger;
}
then reject;
}
term ACCEPT_OTHERS {
then accept;
}
}

Verify that an export source-active filter has been applied to MSDP.

protocols {
…
…
…
}
msdp {
export SA_IMPORT;

If the router is not configured with an export policy to block local source-active multicast advertisements, this is a finding.

Vulnerability Number

V-217096

Documentable

False

Rule Version

JUNI-RT-000920

Severity Override Guidance

Review the router configuration to determine if there is export policy to block local source-active multicast advertisements.

Verify that the router is configured with an export policy to filter multicast source-active advertisements.

policy-options {
…
…
…
}
policy-statement SA_EXPORT {
term INTERNAL_GROUP {
from {
route-filter 239.0.0.0/8 orlonger;
}
then reject;
}
term INTERNAL_ADDR {
from {
source-address-filter 10.0.0.0/8 orlonger;
}
then reject;
}
term ACCEPT_OTHERS {
then accept;
}
}

Verify that an export source-active filter has been applied to MSDP.

protocols {
…
…
…
}
msdp {
export SA_IMPORT;

If the router is not configured with an export policy to block local source-active multicast advertisements, this is a finding.

Check Content Reference

M

Target Key

4032

Comments