STIGQter: STIG Summary: Cisco IOS-XE Switch RTR Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The MPLS switch with RSVP-TE enabled must be configured with message pacing to adjust maximum burst and maximum number of RSVP messages to an output queue based on the link speed and input queue size of adjacent core switches.

DISA Rule

SV-221035r622190_rule

Vulnerability Number

V-221035

Group Title

SRG-NET-000193-RTR-000001

Rule Version

CISC-RT-000610

Severity

CAT III

CCI(s)

• CCI-001095 - The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure the switch to rate limit RSVP messages per interface as shown in the example.

SW2(config)#ip rsvp signalling rate-limit burst 9 maxsize 2100 period 30 limit 50

Check Contents

Review the switch configuration to determine RSVP messages are rate limited.

Step 1: Determine if MPLS TE is enabled globally and at least one interface as shown in the example below:

mpls traffic-eng tunnels
…
…
…
interface GigabitEthernet0/2
no switchport
ip address x.x.x.x 255.255.255.0
mpls traffic-eng tunnels
mpls ip

Step 2: If MPLS TE is enabled, verify that message pacing is enabled.

ip rsvp signalling rate-limit period 30 burst 9 maxsize 2100 limit 50

Note: The command "ip rsvp msg-pacing" has been deprecated by the command "ip rsvp signalling rate-limit".

If the switch with RSVP-TE enabled does not rate limit RSVP messages based on the link speed and input queue size of adjacent core switches, this is a finding.

Vulnerability Number

V-221035

Documentable

False

Rule Version

CISC-RT-000610

Severity Override Guidance

Review the switch configuration to determine RSVP messages are rate limited.

Step 1: Determine if MPLS TE is enabled globally and at least one interface as shown in the example below:

mpls traffic-eng tunnels
…
…
…
interface GigabitEthernet0/2
no switchport
ip address x.x.x.x 255.255.255.0
mpls traffic-eng tunnels
mpls ip

Step 2: If MPLS TE is enabled, verify that message pacing is enabled.

ip rsvp signalling rate-limit period 30 burst 9 maxsize 2100 limit 50

Note: The command "ip rsvp msg-pacing" has been deprecated by the command "ip rsvp signalling rate-limit".

If the switch with RSVP-TE enabled does not rate limit RSVP messages based on the link speed and input queue size of adjacent core switches, this is a finding.

Check Content Reference

M

Target Key

4074

Comments