The Nokia layer 2 switch must have Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping configured on all virtual local area networks (VLANs).

Severity
Group ID
Group Title
Version
Rule ID
Date
STIG Version
lowV-283687SRG-NET-000512-L2S-000002NOKI-L2-000150SV-283687r1204134_rule2026-06-151

Description

IGMP and MLD snooping provides a way to constrain multicast traffic at layer 2. By monitoring the IGMP or MLD membership reports sent by hosts within a VLAN, the snooping application can set up layer 2 multicast forwarding tables to deliver specific multicast traffic only to interfaces connected to hosts interested in receiving the traffic. This significantly reduces the volume of multicast traffic that would otherwise flood the VLAN.

ℹ️ Check

Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively. Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping: - show service id 10 igmp-snooping base IGMP Snooping Base info for service 10 Admin State : Up Querier : No querier found SBD service : N/A Evpn-proxy : Disabled Port Oper MRtr Pim Send Max Max Max MVR Num Id Stat Port Port Qrys Grps Srcs Grp From-VPLS Grps Srcs sap:1/1/c3/10 Up No No No None None None Local 0 - show service id 10 mld-snooping base MLD Snooping Base info for service 10 Admin State : Up Querier : No querier found SBD service : N/A Evpn-proxy : Disabled Port Oper MRtr Send Max MVR Num Id Stat Port Qrys Grps From-VPLS Grps sap:1/1/c3/10 Up No No None Local 0 If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

✔️ Fix

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN. The igmp-snooping and mld-snooping can be configured at the VPLS service level or for each access point (VLAN). For VPLS service-level configuration: - configure service vpls <service id> igmp-snooping no shutdown - configure service vpls <service id> mld-snooping no shutdown For VPLS service access point-level configuration: - configure service vpls <service id> sap <sap id> igmp-snooping - configure service vpls <service id> sap <sap id> mld-snooping