Detections
Analytics

1.32 CISC-RT-000510

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Cisco BGP switch must be configured to reject inbound route advertisements from a customer edge (CE) switch for prefixes that are not allocated to that customer.

GROUP ID: V-221105
RULE ID: SV-221105r999714

As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multi-homed customer with BGP speaking switches connected to the Internet or other external networks could be breached and used to launch a prefix de-aggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.

Solution

Configure the switch to reject inbound route advertisements from each CE switch for prefixes that are not allocated to that customer.

Step 1 : Configure a prefix list for each customer containing prefixes belonging to each.

SW1(config)# ip prefix-list PREFIX_FILTER_CUST1 permit x.13.1.0/24 le 32
SW1(config)# ip prefix-list PREFIX_FILTER_CUST1 deny 0.0.0.0/0 ge 8
SW1(config)# ip prefix-list PREFIX_FILTER_CUST2 permit x.13.2.0/24 le 32
SW1(config)# ip prefix-list PREFIX_FILTER_CUST2 deny 0.0.0.0/0 ge 8

Step 2 : Apply the prefix list filter inbound to each CE neighbor as shown in the example below:

SW1(config)# router bgp xx
SW1(config-router)# neighbor x.55.14.2
SW1(config-router-neighbor)# address-family ipv4 unicast
SW1(config-router-neighbor-af)# prefix-list PREFIX_FILTER_CUST1 in
SW1(config-router-neighbor-af)# exit
SW1(config-router-neighbor)# exit
SW1(config-router)# neighbor x.55.14.4
SW1(config-router-neighbor)# address-family ipv4 unicast
SW1(config-router-neighbor-af)# prefix-list PREFIX_FILTER_CUST2 in
SW1(config-router-neighbor-af)# end

See Also

https://workbench.cisecurity.org/benchmarks/22581

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCI|CCI-001368, CSCv7|13.3, Rule-ID|SV-221105r999714_rule, STIG-ID|CISC-RT-000510, Vuln-ID|V-221105

Plugin: Cisco

Control ID: 3056609efe88ed6803503ef31e84feedbe1dd3d1beb949f25c958430453bbb6b