The administrator must ensure that Protocol Independent Multicast (PIM) is disabled on all interfaces that are not required to support multicast routing.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30577	NET-MCAST-001	SV-40312r1_rule	ECSC-1	Medium

Description
A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.

Description

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be “convex from a routing perspective”—that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, “One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces.” Hence, it is imperative that the network has documented their multicast topology and thereby knows which interfaces are enabled for multicast. Once, this is done, the zones can be scoped as required.

STIG	Date
Perimeter L3 Switch Security Technical Implementation Guide - Cisco	2015-06-30

Details

Check Text ( C-39164r1_chk )
If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM. Step 1: Determine if multicast routing is enabled. By default, multicast is disabled globally. The following global configuration commands will enable IPv4 and IPv6 multicast routing: ip multicast-routing ipv6 multicast-routing Step 2: PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. Review all interface configurations and verify that only the required interfaces are enabled for PIM as documented in the network topology diagram. With IPv4, PIM is disabled by default on all interfaces. Following is an example of an interface with PIM enabled. interface FastEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip pim sparse-mode You can also verify what IPv4 interfaces are enabled for PIM with the show ip pim interface command. With IPv6, PIM is enabled by default on all IPv6-enabled interfaces if IPv6 multicast routing is enabled on the router via the global ipv6 multicast-routing command. An interface can be disabled for PIM using the no ipv6 pim interface command. interface FastEthernet0/1 ipv6 address 2001:1:0:146::/64 eui-64 no ipv6 pim You can also verify what ipv6 interfaces are enabled for PIM with the show ipv6 pim interface command.

Check Text ( C-39164r1_chk )

If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Review the router or multi-layer switch configuration to determine if multicast routing is enabled and what interfaces are enabled for PIM.

Step 1: Determine if multicast routing is enabled. By default, multicast is disabled globally. The following global configuration commands will enable IPv4 and IPv6 multicast routing:

ip multicast-routing

ipv6 multicast-routing

Step 2: PIM is enabled on an interface with either of the following commands: ip pim sparse-mode, ip pim dense-mode, ip pim sparse-dense-mode. Review all interface configurations and verify that only the required interfaces are enabled for PIM as documented in the network topology diagram.

With IPv4, PIM is disabled by default on all interfaces. Following is an example of an interface with PIM enabled.

interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip pim sparse-mode

You can also verify what IPv4 interfaces are enabled for PIM with the show ip pim interface command.

With IPv6, PIM is enabled by default on all IPv6-enabled interfaces if IPv6 multicast routing is enabled on the router via the global ipv6 multicast-routing command. An interface can be disabled for PIM using the no ipv6 pim interface command.

interface FastEthernet0/1
ipv6 address 2001:1:0:146::/64 eui-64
no ipv6 pim

You can also verify what ipv6 interfaces are enabled for PIM with the show ipv6 pim interface command.

Fix Text (F-34295r1_fix)
If IPv4 or IPv6 multicast routing is enabled, ensure that all interfaces enabled for PIM is documented in the network’s multicast topology diagram. Enable PIM only on the applicable interfaces according to the multicast topology diagram.