Multicast register messages must be rate limited per each source-group (S, G) entry.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-251394	NET2012	SV-251394r853656_rule		Medium

Description
When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the Rendezvous Point (RP) using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

Description

When a new source starts transmitting in a PIM Sparse Mode network, the DR will encapsulate the multicast packets into register messages and forward them to the Rendezvous Point (RP) using unicast. This process can be taxing on the CPU for both the DR and the RP if the source is running at a high data rate and there are many new sources starting at the same time. This scenario can potentially occur immediately after a network failover. The rate limit for the number of register messages should be set to a relatively low value based on the known number of multicast sources within the multicast domain.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2023-02-13

Details

Check Text ( C-54829r806135_chk )
Review the configuration of the DR to verify that it is rate limiting the number of multicast register messages. If the DR is not limiting multicast register messages, this is a finding. The following is a PIM sparse mode configuration example that limits the number of register messages for each (S, G) multicast entry to 10 per second. ip multicast-routing ! interface FastEthernet 0/0 description link to core ip address 192.168.123.2 255.255.255.0 ip pim sparse-mode ! interface FastEthernet 0/1 description User LAN ip address 192.168.122.1 255.255.255.0 ip pim sparse-mode ! ip pim rp-address 1.1.1.1 ip pim register-rate 10

Check Text ( C-54829r806135_chk )

Review the configuration of the DR to verify that it is rate limiting the number of multicast register messages.

If the DR is not limiting multicast register messages, this is a finding.

The following is a PIM sparse mode configuration example that limits the number of register messages for each (S, G) multicast entry to 10 per second.

ip multicast-routing
!
interface FastEthernet 0/0
description link to core
ip address 192.168.123.2 255.255.255.0
ip pim sparse-mode
!
interface FastEthernet 0/1
description User LAN
ip address 192.168.122.1 255.255.255.0
ip pim sparse-mode
!
ip pim rp-address 1.1.1.1
ip pim register-rate 10

Fix Text (F-54782r806136_fix)
Configure the Designated Router (DR) to rate limit the number of multicast register messages it will allow for each (S, G) entry.