Rule version NOKI-L2-000150 · STIG v1 · 2026-06-15
IGMP and MLD snooping provides a way to constrain multicast traffic at layer 2. By monitoring the IGMP or MLD membership reports sent by hosts within a VLAN, the snooping application can set up layer 2 multicast forwarding tables to deliver specific multicast traffic only to interfaces connected to hosts interested in receiving the traffic. This significantly reduces the volume of multicast traffic that would otherwise flood the VLAN.
Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.
Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping:
- show service id 10 igmp-snooping base
IGMP Snooping Base info for service 10
Admin State : Up Querier : No querier found SBD service : N/A Evpn-proxy : Disabled Port Oper MRtr Pim Send Max Max Max MVR Num Id Stat Port Port Qrys Grps Srcs Grp From-VPLS Grps Srcs
sap:1/1/c3/10 Up No No No None None None Local 0
- show service id 10 mld-snooping base
MLD Snooping Base info for service 10
Admin State : Up Querier : No querier found SBD service : N/A Evpn-proxy : Disabled
Port Oper MRtr Send Max MVR Num Id Stat Port Qrys Grps From-VPLS Grps
sap:1/1/c3/10 Up No No None Local 0
If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.
Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.
The igmp-snooping and mld-snooping can be configured at the VPLS service level or for each access point (VLAN).
For VPLS service-level configuration:
- configure service vpls <service id> igmp-snooping no shutdown - configure service vpls <service id> mld-snooping no shutdown
For VPLS service access point-level configuration:
- configure service vpls <service id> sap <sap id> igmp-snooping - configure service vpls <service id> sap <sap id> mld-snooping