The Juniper MPLS router must be configured to synchronize IGP and LDP to minimize packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254062	JUEX-RT-000900	SV-254062r844219_rule		Low

Description
Packet loss can occur when an IGP adjacency is established and the router begins forwarding packets using the new adjacency before the LDP label exchange completes between the peers on that link. Packet loss can also occur if an LDP session closes and the router continues to forward traffic using the link associated with the LDP peer rather than an alternate pathway with a fully synchronized LDP session. The MPLS LDP-IGP Synchronization feature provides a means to synchronize LDP with OSPF or IS-IS to minimize MPLS packet loss. When an IGP adjacency is established on a link but LDP-IGP synchronization is not yet achieved or is lost, the IGP will advertise the max-metric on that link.

Description

Packet loss can occur when an IGP adjacency is established and the router begins forwarding packets using the new adjacency before the LDP label exchange completes between the peers on that link. Packet loss can also occur if an LDP session closes and the router continues to forward traffic using the link associated with the LDP peer rather than an alternate pathway with a fully synchronized LDP session. The MPLS LDP-IGP Synchronization feature provides a means to synchronize LDP with OSPF or IS-IS to minimize MPLS packet loss. When an IGP adjacency is established on a link but LDP-IGP synchronization is not yet achieved or is lost, the IGP will advertise the max-metric on that link.

STIG	Date
Juniper EX Series Switches Router Security Technical Implementation Guide	2023-03-23

Details

Check Text ( C-57514r844217_chk )
Review the router OSPF or IS-IS configuration. Verify that LDP will synchronize with the link-state routing protocol. [edit protocols] ospf { area { interface . { authentication { md5 key "$8$aes256-gcm$hmac-sha2-256$100$LfJ7NdAYx/0$+4wGg1QJKLzkaAmVCGxBUQ$n0XxNofUtXE8aoJBhFNDDQ$uIDW/H+VY6U"; ## SECRET-DATA } ldp-synchronization { hold-time 10; } } interface . { ipsec-sa ; ldp-synchronization { hold-time 10; } } } } ldp { interface .; } -OR- isis { interface . { ldp-synchronization { hold-time 10; } } level 1 authentication-key-chain ; level 2 authentication-key-chain ; } mpls { interface .; } If the router is not configured to synchronize IGP and LDP, this is a finding.

Check Text ( C-57514r844217_chk )

Review the router OSPF or IS-IS configuration.

Verify that LDP will synchronize with the link-state routing protocol.
[edit protocols]
ospf {
area {
interface . {
authentication {
md5 key "$8$aes256-gcm$hmac-sha2-256$100$LfJ7NdAYx/0$+4wGg1QJKLzkaAmVCGxBUQ$n0XxNofUtXE8aoJBhFNDDQ$uIDW/H+VY6U"; ## SECRET-DATA
}
ldp-synchronization {
hold-time 10;
}
}
interface . {
ipsec-sa ;
ldp-synchronization {
hold-time 10;
}
}
}
}
ldp {
interface .;
}
-OR-
isis {
interface . {
ldp-synchronization {
hold-time 10;
}
}
level 1 authentication-key-chain ;
level 2 authentication-key-chain ;
}
mpls {
interface .;
}

If the router is not configured to synchronize IGP and LDP, this is a finding.

Fix Text (F-57465r844218_fix)
Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange. set protocols ospf area interface . authentication md5 set protocols ospf area interface . ldp-synchronize hold-time 10 set protocols ldp interface . -OR- set protocols isis level 1 authentication-key-chain set protocols isis level 2 authentication-key-chain set protocols isis interface . ldp-synchronize hold-time 10 set protocols mpls interface .

Fix Text (F-57465r844218_fix)

Configure the MPLS router to synchronize IGP and LDP, minimizing packet loss when an IGP adjacency is established prior to LDP peers completing label exchange.

set protocols ospf area interface . authentication md5
set protocols ospf area interface . ldp-synchronize hold-time 10
set protocols ldp interface .

-OR-

set protocols isis level 1 authentication-key-chain
set protocols isis level 2 authentication-key-chain
set protocols isis interface . ldp-synchronize hold-time 10
set protocols mpls interface .