Detections
Analytics
1.52 CISC-RT-000510
Information
The Cisco BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.GROUP ID: V-216779RULE ID: SV-216779r531087
As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multi-homed customer with BGP speaking routers connected to the Internet or other external networks could be breached and used to launch a prefix de-aggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.
Solution
Configure the router to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer.Step 1: Configure a prefix set for each customer containing prefixes belonging to each as shown in the example.
RP/0/0/CPU0:R2(config)#prefix-set CUST1_PREFIXRP/0/0/CPU0:R2(config-pfx)#x.1.1.0/24 le 32RP/0/0/CPU0:R2(config-pfx)#end-setRP/0/0/CPU0:R2(config)#prefix-set CUST2_PREFIXRP/0/0/CPU0:R2(config-pfx)#x.2.1.0/24 le 32RP/0/0/CPU0:R2(config-pfx)#end-set
Step 2: Configure a route policy filter for each customer as shown in the example.
RP/0/0/CPU0:R2(config)#route-policy CUST1_PREFIX_FILTER
RP/0/0/CPU0:R2(config-rpl)#if destination in CUST1_PREFIX thenRP/0/0/CPU0:R2(config-rpl-if)#passRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#dropRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policyRP/0/0/CPU0:R2(config)#route-policy CUST2_PREFIX_FILTER
RP/0/0/CPU0:R2(config-rpl)#if destination in CUST2_PREFIX thenRP/0/0/CPU0:R2(config-rpl-if)#passRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#dropRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policy
Step 3: Apply the route policy to each customer neighbor as shown in the example.
RP/0/0/CPU0:R2(config)#router bgp xxRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.14RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy CUST1_PREFIX_FILTER inRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.16RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy CUST2_PREFIX_FILTER in
See Also
Item Details
Audit Name: CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|II, CCI|CCI-001368, Rule-ID|SV-216779r531087_rule, STIG-ID|CISC-RT-000510, Vuln-ID|V-216779
Plugin: Cisco
Control ID: b0b79f01439d9d3c8683cb5314702b5dac57c388506852f9bdf8c13d3bdfe870