Detections
Analytics
1.54 CISC-RT-000530
Information
The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.GROUP ID: V-216781RULE ID: SV-216781r531087
Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.
Solution
Step 1: Configure a prefix set containing the IP core prefix as shown below.RP/0/0/CPU0:R2(config)#prefix-set
Step 2: Configure a prefix set containing the current Bogon prefixes as shown below.
RP/0/0/CPU0:R2(config)#prefix-set CORE_PREFIXRP/0/0/CPU0:R2(config-pfx)#10.1.1.0/24 le 32RP/0/0/CPU0:R2(config-pfx)#end-set
Step 3: Configure the route policy to drop route advertisements for IP core prefixes as shown in the example below.
RP/0/0/CPU0:R2(config)#route-policy BGP_FILTER_OUTBOUNDRP/0/0/CPU0:R2(config-rpl)#if destination in CORE_PREFIX thenRP/0/0/CPU0:R2(config-rpl-if)#dropRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#passRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policy
Step 4: Apply the route policy to each external BGP neighbor as shown in the example.
RP/0/0/CPU0:R2(config)#router bgp xxRP/0/0/CPU0:R2(config-bgp)#neighbor x.1.23.3RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy BGP_FILTER_OUTBOUND outRP/0/0/CPU0:R2(config-bgp)#neighbor x.1.24.4RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy BGP_FILTER_ OUTBOUND out
See Also
Item Details
Audit Name: CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-216781r531087_rule, STIG-ID|CISC-RT-000530, Vuln-ID|V-216781
Plugin: Cisco
Control ID: 108ca4465b6fad9085c5744785cb51206307474e8ceed4ad6377fcfea5d15c6c