Secure MPLS configuration: Does TCP port 646 (LDP) need to be generally exposed?

Question

I am looking for expertise on MPLS configurations and security. A recent Nmap scan of my organization's public IPv4 perimeter networks has discovered a system which appears to be listening on TCP port 646. This port would appear to be associated with the LDP (Label Distribution Protocol) associated with MPLS. There is other evidence which suggests that this node is a networking device, so it makes sense. I am not yet certain what make/type of networking device it is.

However, this node is listening on TCP 646 when I am scanning it from a miscellaneous public IP address (i.e. it is generally exposed on the Internet). My assumption would be that this port should only be exposed to peer device(s), not exposed on the internet generally. However, I do not have the requisite MPLS knowledge to make this claim.

I have searched the web for guidance on this front, but I have been unable to come up with any opinions on the matter, much less facts.

Does anybody out there have sufficient MPLS experience to state whether or not this port must be listening on the Internet, or if it should only be listening to devices from a certain network (e.g., its network peers)? Are you able to point towards any documentation (e.g., vendor documentation) in support of this?

Answer 1

Your concern is valid. Routers should be configured with a control plane filter to prevent undesired access to routing protocol listening ports, including LDP.

It sounds like you are an infosec professional in a larger organization. You should raise this concern with your org's network engineers.