MSDP Authentication & SA Filtering

HighLevel 1Manual reviewaruba-cx

Description

The Multicast Source Discovery Protocol (MSDP) connects multiple PIM-SM domains, enabling RPs to share multicast source information using SA messages over TCP. It simplifies interdomain multicast routing by supporting an interdomain source tree instead of a shared tree.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Where MSDP runs, run 'show run msdp' and confirm every peer has a password and SA filters in and out ('sa-filter in/out access-list <acl>').

How it is fixed

Fix method: Guidance or infrastructure patch

Configuration to enable Authentication - router msdp ip msdp peer <ip-address> password plaintext <password> User can prevent the incoming and outgoing SA messages on MSDP router by creating incoming and outgoing filter lists using an ACL. Configuration to associate ACL - sa-filter in access-list <acl-name> sa-filter out access-list <acl-name>

Properties

Operating systems: Any
Tags: aruba-cxauthentication
Reference: CIS HPE Aruba Networking CX Switch Benchmark v1.0.1 - 3.3.5 MSDP Authentication & SA Filtering