The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

An XCCDF Rule

Description

MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP routers must be configured to only accept MSDP packets from known MSDP peers.

ID: SV-254052r844189_rule
Version: JUEX-RT-000800
Severity: Medium
References: CCI-002403
Updated: 5 days ago

Remediation Templates

Ensure the receive path or interface filter for all MSDP routers only accepts MSDP packets from known MSDP peers.

set firewall family inet filter <name> term 1 from source-prefix-list msdp-peers
set firewall family inet filter <name> term 1 from protocol tcp
set firewall family inet filter <name> term 1 from destination-port msdp
set firewall family inet filter <name> term 1 then acceptset firewall family inet filter <name> term 2 from source-prefix-list msdp-peers
set firewall family inet filter <name> term 2 from protocol tcp
set firewall family inet filter <name> term 2 from source-port msdp
set firewall family inet filter <name> term 2 then accept
<additional terms>
set firewall family inet filter <name> term default then syslog
set firewall family inet filter <name> term default then discard

set firewall family inet6 filter <name> term 1 from source-prefix-list msdp-peers-ipv6
set firewall family inet6 filter <name> term 1 from next-header tcp
set firewall family inet6 filter <name> term 1 from destination-port msdp
set firewall family inet6 filter <name> term 1 then accept
set firewall family inet6 filter <name> term 2 from source-prefix-list msdp-peers-ipv6
set firewall family inet6 filter <name> term 2 from next-header tcp
set firewall family inet6 filter <name> term 2 from source-port msdp
set firewall family inet6 filter <name> term 2 then accept
<additional terms>
set firewall family inet6 filter <name> term default then syslog
set firewall family inet6 filter <name> term default then discard

set interfaces <external interface> unit <number> family inet filter input <IPv4 filter name>
set interfaces <external interface> unit <number> family inet address <IPv4 address>/<mask>
set interfaces <external interface> unit <number> family inet6 filter input <IPv6 filter name>
set interfaces <external interface> unit <number> family inet6 address <IPv6 address>/<prefix>

set interfaces lo0 unit <number> family inet filter input <IPv4 filter name>
set interfaces lo0 unit <number> family inet address <IPv4 address>/32
set interfaces lo0 unit <number> family inet6 filter input <IPv6 filter name>
set interfaces lo0 unit <number> family inet6 address <IPv6 address>/128

The Juniper Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

Description

Remediation Templates

A Manual Procedure