3.1.2.1 Configure BGP to Log Neighbor Changes

Information

Logging changes to the BGP peering relationships is recommended. Any logged changes will in the best case indicate a service issue due to standard operational issues (connectivity issues and so on) or in the worst case, could indicate malicious activity attempting to subvert the peering relationship and/or the routing table.

Rationale:

Solution

In each 'neigbor' stanza of the BGP configuration, add the command 'log-neighbor-changes'

switch(config)# router bgp <asn>
switch(config-router)# router-id <local ip, preferably a loopback>
switch(config-router)# neighbor <neighbor ip address>
switch(config-router-neighbor)# remote-as <neighbor asn>
switch(config-router-neighbor)# log-neighbor-changes

In addition, the events below should be configured in any log or SIEM solution to generate an alert for investigation. A good keyword to alert on is 'ADJCHANGE'

2020 May 20 11:54:18 CISNXOS9 %BGP-5-ADJCHANGE: bgp- [7984] (default) neighbor 10.10.10.11 Up
2020 May 20 13:08:15 CISNXOS9 %BGP-5-ADJCHANGE: bgp- [7984] (default) neighbor 10.10.10.11 Down - sent: holdtimer expired error

Default Value:

Not enabled

See Also

https://workbench.cisecurity.org/files/3102

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Cisco

Control ID: 9402234ca8f671d3bb93b741ed68bb5323fa5d667a31afa1dd7dd3aaf59edc11