Skip to content
Log In

The Cisco Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

An XCCDF Rule

Description

MSDP peering with customer network routers presents additional risks to the DISN Core, whether from a rogue or misconfigured MSDP-enabled router. To guard against an attack from malicious MSDP traffic, the receive path or interface filter for all MSDP-enabled RP routers must be configured to only accept MSDP packets from known MSDP peers.

ID
SV-216728r855834_rule
Version
CISC-RT-000900
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Configure the receive path or interface ACLs to only accept MSDP packets from known MSDP peers.

R8(config)#ip access-list extended EXTERNAL_ACL_INBOUND
R8(config-ext-nacl)#permit tcp any any established
R8(config-ext-nacl)#permit tcp host x.1.28.2 host x.1.28.8 eq 639
R8(config-ext-nacl)#deny tcp any host x1.28.8 eq 639