STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 9 Release: 10 Benchmark Date: 24 Jan 2020:

Label Distribution Protocol (LDP) must be synchronized with the Interior Gateway Protocol (IGP) to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

DISA Rule

SV-80847r1_rule

Vulnerability Number

V-66357

Group Title

NET2002

Rule Version

NET2002

Severity

CAT III

CCI(s)

• CCI-001549 - The organization defines the information flow control policies for controlling the flow of information between interconnected systems.

Weight

10

Fix Recommendation

Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

Check Contents

Review the router configuration and verify that the "mpls ldp sync" command is configured on the IS-IS or OSPF configuration as shown in the following example:

mpls ip
mpls label protocol ldp
!
interface POS0/3
ip router isis
mpls ip
...
...
...
router isis
mpls ldp sync

If not all MPLS routers synchronize IGP and LDP, this is a finding.

Note: If the LDP peer is reachable, the IGP waits indefinitely (by default) for synchronization to be achieved. To limit the length of time the IGP session must wait, enter the "mpls ldp igp sync holddown" command. If the LDP peer is not reachable, the IGP establishes the adjacency to enable the LDP session to be established.

Vulnerability Number

V-66357

Documentable

False

Rule Version

NET2002

Severity Override Guidance

Review the router configuration and verify that the "mpls ldp sync" command is configured on the IS-IS or OSPF configuration as shown in the following example:

mpls ip
mpls label protocol ldp
!
interface POS0/3
ip router isis
mpls ip
...
...
...
router isis
mpls ldp sync

If not all MPLS routers synchronize IGP and LDP, this is a finding.

Note: If the LDP peer is reachable, the IGP waits indefinitely (by default) for synchronization to be achieved. To limit the length of time the IGP session must wait, enter the "mpls ldp igp sync holddown" command. If the LDP peer is not reachable, the IGP establishes the adjacency to enable the LDP session to be established.

Check Content Reference

M

Target Key

838

Comments