The Juniper multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90959	JUNI-RT-000840	SV-101169r1_rule		Medium

Description
When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

Description

When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the RP using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2020-06-04

Details

Check Text ( C-90223r2_chk )
Review the configuration of the RP to verify that it is rate limiting the number of multicast register messages. protocols { … … … } pim { rp { register-limit maximum nnnnn; local { address 2.2.2.2; } } Note: Each any-source group (*,G) counts as one group toward the limit. Each source-specific group (S,G) counts as one group toward the limit. If the RP is not limiting multicast register messages, this is a finding.

Check Text ( C-90223r2_chk )

Review the configuration of the RP to verify that it is rate limiting the number of multicast register messages.

protocols {
…
…
…
}
pim {
rp {
register-limit maximum nnnnn;
local {
address 2.2.2.2;
}
}

Note: Each any-source group (*,G) counts as one group toward the limit. Each source-specific group (S,G) counts as one group toward the limit.

If the RP is not limiting multicast register messages, this is a finding.

Fix Text (F-97267r2_fix)
Configure the RP to rate limit the number of multicast register messages it will allow for each (S, G) entry. [edit protocols pim rp] set register-limit maximum nnnnn