Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping must be implemented within the network access layer.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66393	NET2016	SV-80883r1_rule		Low

Description
The last-hop router sends the multicast packet out the interface towards the LAN containing interested receivers. The default behavior for a Layer 2 switch is to forward all multicast traffic out every access switch port that belongs to the VLAN. IGMP snooping is a mechanism used by "Layer 3 aware" switches to maintain a Layer 2 multicast table by examining all IGMP join and leave messages (destined to the all router's multicast address 224.0.0.2) sent between hosts and the multicast routers on the LAN. This will enable the switch to only forward multicast packets out the access switch ports that have connected hosts that have subscribed to the multicast group, thereby reducing the load on the switching backplane as well as eliminating unwanted traffic to uninterested hosts.

Description

The last-hop router sends the multicast packet out the interface towards the LAN containing interested receivers. The default behavior for a Layer 2 switch is to forward all multicast traffic out every access switch port that belongs to the VLAN. IGMP snooping is a mechanism used by "Layer 3 aware" switches to maintain a Layer 2 multicast table by examining all IGMP join and leave messages (destined to the all router's multicast address 224.0.0.2) sent between hosts and the multicast routers on the LAN. This will enable the switch to only forward multicast packets out the access switch ports that have connected hosts that have subscribed to the multicast group, thereby reducing the load on the switching backplane as well as eliminating unwanted traffic to uninterested hosts.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2019-03-12

Details

Check Text ( C-67041r1_chk )
Review the access switches connected to multicast last-hop routers to determine if IGMP snooping is enabled. The following are switch configuration examples with IGMP snooping enabled globally and on a per-VLAN basis: Enable IGMP Snooping globally: ip igmp snooping Enable IGMP Snooping for VLAN: ip igmp snooping vlan 7 If any switches within the ICAN access layer do not have IGMP or MLD snooping enabled, this is a finding.

Check Text ( C-67041r1_chk )

Review the access switches connected to multicast last-hop routers to determine if IGMP snooping is enabled. The following are switch configuration examples with IGMP snooping enabled globally and on a per-VLAN basis:

Enable IGMP Snooping globally: ip igmp snooping

Enable IGMP Snooping for VLAN: ip igmp snooping vlan 7

If any switches within the ICAN access layer do not have IGMP or MLD snooping enabled, this is a finding.

Fix Text (F-72469r1_fix)
Configure the switch to implement IGMP or MLD snooping, ensuring multicast traffic for any given multicast group is forwarded to only those hosts that have joined the group.