Detections
Analytics

1.55 CISC-RT-000530

Information

The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

GROUP ID: V-216691
RULE ID: SV-216691r929058

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.

Solution

Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below:

R1(config)#ip prefix-list FILTER_CORE_PREFIXES deny x.1.1.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES deny x.1.2.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES permit 0.0.0.0/0 ge 8

Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example.

router bgp xx
 address-family ipv4
 neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out

See Also

https://workbench.cisecurity.org/benchmarks/26261

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-216691r929058_rule, STIG-ID|CISC-RT-000530, Vuln-ID|V-216691

Plugin: Cisco

Control ID: 866f263f34f53df121f75c5ed99ff1fb4bc53bd034838178ce70a097e6880a48