The Juniper multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90953	JUNI-RT-000810	SV-101163r1_rule		Low

Description
MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.

Description

MSDP peering between networks enables sharing of multicast source information. Enclaves with an existing multicast topology using PIM-SM can configure their RP routers to peer with MSDP routers. As a first step of defense against a denial-of-service (DoS) attack, all RP routers must limit the multicast forwarding cache to ensure that router resources are not saturated managing an overwhelming number of PIM and MSDP source-active entries.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2018-11-15

Details

Check Text ( C-90217r1_chk )
Review the router configuration to determine if forwarding cache thresholds are defined as shown in the example below. routing-options { multicast { … … … } forwarding-cache { threshold { suppress 5000; reuse 4000; } } } } If the RP router is not configured to limit the multicast forwarding cache to ensure that its resources are not saturated, this is a finding.

Fix Text (F-97261r2_fix)
Configure the router to limit the multicast forwarding cache for source-active entries. [edit routing-options multicast] set forwarding-cache threshold suppress 5000 reuse 4000