Detections
Analytics
1.51 CISC-RT-000500
Information
The Cisco BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).GROUP ID: V-216778RULE ID: SV-216778r531087
Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a non-optimized path.
Solution
Step 1: Configure a prefix set containing the current Bogon prefixes as shown below.RP/0/0/CPU0:R2(config)#prefix-set Step 1: Configure a prefix set containing the current Bogon prefixes as shown below.
RP/0/0/CPU0:R2(config)#prefix-set LOCAL_PREFIXRP/0/0/CPU0:R2(config-pfx)#x.13.1.0/24 le 32RP/0/0/CPU0:R2(config-pfx)#end-set
Step 2: Configure the route policy to drop routes with BOGON prefixes as shown in the example below.
RP/0/0/CPU0:R2(config)#route-policy BGP_FILTER_INBOUNDRP/0/0/CPU0:R2(config-rpl)#if destination in LOCAL_PREFIX thenRP/0/0/CPU0:R2(config-rpl-if)#dropRP/0/0/CPU0:R2(config-rpl-if)#else pass endifRRP/0/0/CPU0:R2(config-rpl)#end-policyRP/0/0/CPU0:R2(config)#exit
Step 3: Apply the route policy to each external BGP neighbor as shown in the example.
RP/0/0/CPU0:R2(config)#router bgp xxRP/0/0/CPU0:R2(config-bgp)#neighbor x.1.23.3RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy BGP_FILTER_INBOUND inRP/0/0/CPU0:R2(config-bgp)#neighbor x.1.24.4RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy BGP_FILTER_INBOUND in
See Also
Item Details
Audit Name: CIS Cisco IOS XR Router RTR STIG v1.0.0 CAT II
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|II, CCI|CCI-001368, Rule-ID|SV-216778r531087_rule, STIG-ID|CISC-RT-000500, Vuln-ID|V-216778
Plugin: Cisco
Control ID: a310e6f0ba9fa1d9b9a07aa6bcb34471c732d46eabddf2116ef09204bfb6ace8