UCF STIG Viewer Logo

Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping must be implemented within the network access layer.


Overview

Finding ID Version Rule ID IA Controls Severity
V-66393 NET2016 SV-80883r1_rule Low
Description
The last-hop router sends the multicast packet out the interface towards the LAN containing interested receivers. The default behavior for a Layer 2 switch is to forward all multicast traffic out every access switch port that belongs to the VLAN. IGMP snooping is a mechanism used by "Layer 3 aware" switches to maintain a Layer 2 multicast table by examining all IGMP join and leave messages (destined to the all router's multicast address 224.0.0.2) sent between hosts and the multicast routers on the LAN. This will enable the switch to only forward multicast packets out the access switch ports that have connected hosts that have subscribed to the multicast group, thereby reducing the load on the switching backplane as well as eliminating unwanted traffic to uninterested hosts.
STIG Date
Network Infrastructure Policy Security Technical Implementation Guide 2017-12-07

Details

Check Text ( C-67041r1_chk )
Review the access switches connected to multicast last-hop routers to determine if IGMP snooping is enabled. The following are switch configuration examples with IGMP snooping enabled globally and on a per-VLAN basis:

Enable IGMP Snooping globally: ip igmp snooping

Enable IGMP Snooping for VLAN: ip igmp snooping vlan 7

If any switches within the ICAN access layer do not have IGMP or MLD snooping enabled, this is a finding.
Fix Text (F-72469r1_fix)
Configure the switch to implement IGMP or MLD snooping, ensuring multicast traffic for any given multicast group is forwarded to only those hosts that have joined the group.