Detections
Analytics

1.58 CISC-RT-000570

Information

The Cisco BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.

GROUP ID: V-216785RULE ID: SV-216785r856446

The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements.

Solution

This requirement is not applicable for the DODIN Backbone.

Configure the router to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer.

Step 1: Configure a prefix set to not include prefixes are longer than /24.

RP/0/0/CPU0:R2(config)#prefix-set PREFIX_LENGTHRP/0/0/CPU0:R2(config-pfx)#0.0.0.0/0 ge 8 le 24RP/0/0/CPU0:R2(config-pfx)#end-set

Step 2: Configure a route policy to only accept prefixes that are /24 or shorter as shown in the example below.

RP/0/0/CPU0:R2(config)#route-policy FILTER_LONG_PREFIXESRP/0/0/CPU0:R2(config-rpl)#if destination in PREFIX_LENGTH thenRP/0/0/CPU0:R2(config-rpl-if)#passRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#dropRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policy

Step 3: Apply the route policy above inbound with each peering CE router as shown in the example below.

RP/0/0/CPU0:R2(config)#router bgp xxRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.14RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy route-policy FILTER_LONG_PREFIXES inRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.16RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy FILTER_LONG_PREFIXES inRP/0/0/CPU0:R2(config-bgp-nbr-af)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|III, CCI|CCI-002385, Rule-ID|SV-216785r856446_rule, STIG-ID|CISC-RT-000570, Vuln-ID|V-216785

Plugin: Cisco

Control ID: a833badbe87dd0d10331631b117442defaa56a85291549c2bf4504f68ac72197