A Protocol Independent Multicast (PIM) neighbor filter must be implemented to restrict and control multicast traffic.

From Network Infrastructure Policy Security Technical Implementation Guide

Part of NET2007

Associated with: CCI-001414

SV-80857r1_rule A Protocol Independent Multicast (PIM) neighbor filter must be implemented to restrict and control multicast traffic.

Vulnerability discussion

Protocol Independent Multicast (PIM) is a routing protocol that is used by the IP core for forwarding multicast traffic. PIM traffic must be limited to only known PIM neighbors by configuring and binding a PIM neighbor filter to those interfaces that have PIM enabled.

Check content

Step 1: Verify that an ACL is configured that will specify the allowable PIM neighbors similar to the following example. ip access-list standard pim-neighbors permit 192.0.2.1 permit 192.0.2.3 Step 2: Verify that a pim neighbor-filter command is configured on all PIM enabled interfaces that is referencing the PIM neighbor ACL similar to the following example: interface GigabitEthernet0/3 ip address 192.0.2.2 255.255.255.0 pim neighbor-filter pim-neighbors If PIM neighbor filter is not bound to interfaces that have PIM enabled, this is a finding.

Fix text

The router administrator configures and binds a PIM neighbor filter to those interfaces that have PIM enabled.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.