STIGQter STIGQter: STIG Summary: Network Infrastructure Policy Security Technical Implementation Guide Version: 9 Release: 10 Benchmark Date: 24 Jan 2020:

The multicast domain must block inbound and outbound administratively-scoped multicast traffic at the edge.

DISA Rule

SV-80859r1_rule

Vulnerability Number

V-66369

Group Title

NET2008

Rule Version

NET2008

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Configure a multicast boundary statement at all COI-facing interfaces that has PIM enabled to block inbound and outbound administratively-scoped multicast traffic.

Check Contents

The administratively-scoped IPv4 multicast address space is 239.0.0.0 through 239.255.255.255. Packets addressed to administratively-scoped multicast addresses must not cross administrative boundaries. This can be accomplished by applying a multicast boundary statement to all COI-facing interfaces as shown in the following example:

ip multicast-routing
!
interface FastEthernet0/0
ip address 199.36.92.1 255.255.255.252
ip pim sparse-mode
ip multicast boundary 1
!
access-list 1 deny 239.0.0.0 0.255.255.255
access-list 1 permit any

If inbound and outbound administratively-scoped multicast traffic is not blocked, this is a finding.

Vulnerability Number

V-66369

Documentable

False

Rule Version

NET2008

Severity Override Guidance

The administratively-scoped IPv4 multicast address space is 239.0.0.0 through 239.255.255.255. Packets addressed to administratively-scoped multicast addresses must not cross administrative boundaries. This can be accomplished by applying a multicast boundary statement to all COI-facing interfaces as shown in the following example:

ip multicast-routing
!
interface FastEthernet0/0
ip address 199.36.92.1 255.255.255.252
ip pim sparse-mode
ip multicast boundary 1
!
access-list 1 deny 239.0.0.0 0.255.255.255
access-list 1 permit any

If inbound and outbound administratively-scoped multicast traffic is not blocked, this is a finding.

Check Content Reference

M

Target Key

838

Comments