The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

An XCCDF Rule

Description

<VulnDiscussion>MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP routers must be configured to only accept MSDP packets from known MSDP peers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-254052r844189_rule
Severity: Medium
References: CCI-002403
Updated: 17 days ago

Ensure the receive path or interface filter for all MSDP routers only accepts MSDP packets from known MSDP peers.

set firewall family inet filter <name> term 1 from source-prefix-list msdp-peers
set firewall family inet filter <name> term 1 from protocol tcp
set firewall family inet filter <name> term 1 from destination-port msdp
set firewall family inet filter <name> term 1 then acceptset firewall family inet filter <name> term 2 from source-prefix-list msdp-peers
set firewall family inet filter <name> term 2 from protocol tcp
set firewall family inet filter <name> term 2 from source-port msdp
set firewall family inet filter <name> term 2 then accept
<additional terms>
set firewall family inet filter <name> term default then syslog
set firewall family inet filter <name> term default then discard

set firewall family inet6 filter <name> term 1 from source-prefix-list msdp-peers-ipv6
set firewall family inet6 filter <name> term 1 from next-header tcp
set firewall family inet6 filter <name> term 1 from destination-port msdp
set firewall family inet6 filter <name> term 1 then accept
set firewall family inet6 filter <name> term 2 from source-prefix-list msdp-peers-ipv6
set firewall family inet6 filter <name> term 2 from next-header tcp
set firewall family inet6 filter <name> term 2 from source-port msdp
set firewall family inet6 filter <name> term 2 then accept
<additional terms>
set firewall family inet6 filter <name> term default then syslog
set firewall family inet6 filter <name> term default then discard

set interfaces <external interface> unit <number> family inet filter input <IPv4 filter name>
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 filter input <IPv6 filter name>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>

set interfaces lo0 unit <number> family inet filter input <IPv4 filter name>
set interfaces lo0 unit <number> family inet address <IPv4 address>/32
set interfaces lo0 unit <number> family inet6 filter input <IPv6 filter name>
set interfaces lo0 unit <number> family inet6 address <IPv6 address>/128

The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

Description

Remediation - Manual Procedure