The administrator must ensure that multicast routers are configured to establish boundaries for Admin-local or Site-local scope multicast traffic.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19189	NET-MCAST-010	SV-21169r1_rule		Low

Description
A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.

Description

A scope zone is an instance of a connected region of a given scope. Zones of the same scope cannot overlap while zones of a smaller scope will fit completely within a zone of a larger scope. For example, Admin-local scope is smaller than Site-local scope, so the administratively configured boundary fits within the bounds of a site. According to RFC 4007 IPv6 Scoped Address Architecture (section 5), scope zones are also required to be "convex from a routing perspective"-that is, packets routed within a zone must not pass through any links that are outside of the zone. This requirement forces each zone to be one contiguous island rather than a series of separate islands. As stated in the DoD IPv6 IA Guidance for MO3, "One should be able to identify all interfaces of a zone by drawing a closed loop on their network diagram, engulfing some routers and passing through some routers to include only some of their interfaces." Administrative scoped multicast addresses are locally assigned and are to be used exclusively by the enterprise network or enclave. Hence, administrative scoped multicast traffic must not cross the perimeter of the enclave in either direction. Admin-local scope could be used to contain multicast traffic to a portion of an enclave or within a site. This can make it more difficult for a malicious user to access sensitive traffic if the traffic is restricted to links that the user does not have access to. Admin-local scope is encouraged for any multicast traffic within a network that is intended for network management as well as control plane traffic that must reach beyond link-local destinations.

STIG	Date
Perimeter L3 Switch Security Technical Implementation Guide - Cisco	2016-12-23

Details

Check Text ( C-23287r1_chk )
An administratively scoped IP multicast region is defined to be a topological region in which there are one or more boundary routers with common boundary definitions. Such a router is said to be a boundary for multicast scoped addresses in the range defined in its configuration. In order to support administratively scoped multicast, a multicast boundary router will drop multicast traffic matching an interface's boundary definition in either direction. The IPv4 administrative scoped multicast address space is 239/8 which is divided into two scope levels: the Local Scope and Organization Local Scope. The Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The IPv4 Organization Local Scope is 239.192.0.0/14 is the space from which an organization should allocate sub-ranges when defining scopes for private use. This scope can be expanded to 239.128.0.0/10, 239.64.0.0/10, and 239.0.0.0/10 if necessary. The scope of IPv6 multicast packets are determined by the scope value where 4 (ffx4::/16) is Admin-local, 5 (ffx5::/16) is Site-local, and 8 (ffx8::/16) is Organization-local. Review the multicast topology to determine any documented Admin-local (scope = 4) or Site-local (scope = 5) multicast boundaries for IPv6 traffic or any Local-scope (address block 239.255.0.0/16) boundary for IPv4 traffic. Verify that appropriate boundaries are configured on the applicable multicast-enabled interfaces. IPv4: The following example will establish a multicast boundary on the interface to ensure that Local-scope traffic is not allowed into or out of the administratively scoped IPv4 multicast region: ip multicast-routing ! interface FastEthernet0/1 description Boundary for multicast region A ip address 198.18.0.1 255.255.255.0 ip pim sparse-mode ip multicast boundary MCAST_ADMIN_SCOPED_BOUNDARY ! ip access-list standard MCAST_ADMIN_SCOPED_BOUNDARY deny 239.255.0.0 0.255.255.255 permit 224.0.0.0 15.255.255.255 ! Note: The filter used by multicast boundary command will effect multicast traffic outside of the administratively scoped IPv4 multicast space. If Organization Local Scope traffic must cross this site boundary, include the necessary permit statement from this address range (239.192.0.0 255.252.0.0). To allow global multicast traffic to pass by this boundary, ensure that the filter will permit the global address space (224.0.1.0-238.255.255.255) if the enclave has deployed inter-domain multicast routing. IPv6: The following example will establish a multicast boundary on the interface to ensure that Site-local scope traffic is not allowed into or out of the administratively scoped IPv6 multicast region: ipv6 multicast-routing ! interface FastEthernet0/1 description link to Site A ipv6 address 2001:1:0:146::/64 eui-64 ipv6 multicast boundary scope 5 Note: Filtering the scope value of 5 will ensure that any multicast traffic received by the interface in either direction with a scope equal to or less than 5 (Site-local) will be dropped. Hence, all Site-local and Admin-local traffic will be dropped while allowing Organization-local (scope = 8) and global multicast traffic (scope =14) to be forwarded for an inter-site as well as inter-domain multicast routing deployment.

Check Text ( C-23287r1_chk )

An administratively scoped IP multicast region is defined to be a topological region in which there are one or more boundary routers with common boundary definitions. Such a router is said to be a boundary for multicast scoped addresses in the range defined in its configuration. In order to support administratively scoped multicast, a multicast boundary router will drop multicast traffic matching an interface's boundary definition in either direction.

The IPv4 administrative scoped multicast address space is 239/8 which is divided into two scope levels: the Local Scope and Organization Local Scope. The Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The IPv4 Organization Local Scope is 239.192.0.0/14 is the space from which an organization should allocate sub-ranges when defining scopes for private use. This scope can be expanded to 239.128.0.0/10, 239.64.0.0/10, and 239.0.0.0/10 if necessary. The scope of IPv6 multicast packets are determined by the scope value where 4 (ffx4::/16) is Admin-local, 5 (ffx5::/16) is Site-local, and 8 (ffx8::/16) is Organization-local.

Review the multicast topology to determine any documented Admin-local (scope = 4) or Site-local (scope = 5) multicast boundaries for IPv6 traffic or any Local-scope (address block 239.255.0.0/16) boundary for IPv4 traffic. Verify that appropriate boundaries are configured on the applicable multicast-enabled interfaces.

IPv4:
The following example will establish a multicast boundary on the interface to ensure that Local-scope traffic is not allowed into or out of the administratively scoped IPv4 multicast region:

ip multicast-routing
!
interface FastEthernet0/1
description Boundary for multicast region A
ip address 198.18.0.1 255.255.255.0
ip pim sparse-mode
ip multicast boundary MCAST_ADMIN_SCOPED_BOUNDARY
!
ip access-list standard MCAST_ADMIN_SCOPED_BOUNDARY
deny 239.255.0.0 0.255.255.255
permit 224.0.0.0 15.255.255.255
!

Note: The filter used by multicast boundary command will effect multicast traffic outside of the administratively scoped IPv4 multicast space. If Organization Local Scope traffic must cross this site boundary, include the necessary permit statement from this address range (239.192.0.0 255.252.0.0). To allow global multicast traffic to pass by this boundary, ensure that the filter will permit the global address space (224.0.1.0-238.255.255.255) if the enclave has deployed inter-domain multicast routing.

IPv6:
The following example will establish a multicast boundary on the interface to ensure that Site-local scope traffic is not allowed into or out of the administratively scoped IPv6 multicast region:

ipv6 multicast-routing
!
interface FastEthernet0/1
description link to Site A
ipv6 address 2001:1:0:146::/64 eui-64
ipv6 multicast boundary scope 5

Note: Filtering the scope value of 5 will ensure that any multicast traffic received by the interface in either direction with a scope equal to or less than 5 (Site-local) will be dropped. Hence, all Site-local and Admin-local traffic will be dropped while allowing Organization-local (scope = 8) and global multicast traffic (scope =14) to be forwarded for an inter-site as well as inter-domain multicast routing deployment.

Fix Text (F-19813r1_fix)
Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.

Fix Text (F-19813r1_fix)

Local Scope range is 239.255.0.0/16 and can expand into the reserved ranges 239.254.0.0/16 and 239.253.0.0/16 if 239.255.0.0/16 is exhausted. The scope of IPv6 multicast packets are determined by the scope value where 4 is Admin-local and 5 is Site-local. Configure the necessary boundary to ensure packets addressed to these administratively scoped multicast addresses do not cross the applicable administrative boundaries.