Detections
Analytics

JUEX-RT-000020 - The Juniper BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Information

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

The list of Bogon addresses can change, based upon new address range assignments, and must be reviewed to ensure filters remain current.

Solution

Ensure all eBGP routers are configured to reject inbound route advertisements for any currently defined Bogon prefixes.

set policy-options route-filter-list bogon 0.0.0.0/8 orlonger
set policy-options route-filter-list bogon 10.0.0.0/8 orlonger
set policy-options route-filter-list bogon 100.64.0.0/10 orlonger
set policy-options route-filter-list bogon 127.0.0.0/8 orlonger
set policy-options route-filter-list bogon 169.254.0.0/16 orlonger
set policy-options route-filter-list bogon 172.16.0.0/12 orlonger
set policy-options route-filter-list bogon 192.0.0.0/24 orlonger
set policy-options route-filter-list bogon 192.0.2.0/24 orlonger
set policy-options route-filter-list bogon 192.168.0.0/16 orlonger
set policy-options route-filter-list bogon 198.18.0.0/15 orlonger
set policy-options route-filter-list bogon 198.51.100.0/24 orlonger
set policy-options route-filter-list bogon 203.0.113.0/24 orlonger
set policy-options route-filter-list bogon 224.0.0.0/4 orlonger
set policy-options route-filter-list bogon 240.0.0.0/4 orlonger

set policy-options route-filter-list bogon-ipv6 ::/128 exact
set policy-options route-filter-list bogon-ipv6 ::1/128 exact
set policy-options route-filter-list bogon-ipv6 ::ffff:0:0/96 orlonger
set policy-options route-filter-list bogon-ipv6 ::/96 orlonger
set policy-options route-filter-list bogon-ipv6 100::/64 orlonger
set policy-options route-filter-list bogon-ipv6 2001:10::/28 orlonger
set policy-options route-filter-list bogon-ipv6 2001:db8::/32 orlonger
set policy-options route-filter-list bogon-ipv6 fc00::/7 orlonger
set policy-options route-filter-list bogon-ipv6 fe80::/10 orlonger
set policy-options route-filter-list bogon-ipv6 fec0::/10 orlonger
set policy-options route-filter-list bogon-ipv6 ff00::/8 orlonger

set policy-options policy-statement bgp-discard term 1 from route-filter-list bogon
set policy-options policy-statement bgp-discard term 1 from route-filter-list bogon-ipv6
set policy-options policy-statement bgp-discard term 1 then reject

set protocols bgp group eBGP import bgp-discard
set protocols bgp group eBGP neighbor 192.0.2.2 import bgp-discard
set protocols bgp import bgp-discard

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M01_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCI|CCI-001368, Rule-ID|SV-253974r843955_rule, STIG-ID|JUEX-RT-000020, Vuln-ID|V-253974

Plugin: Juniper

Control ID: 0d5e483059c829eed892f56c9a1020fa8a450ab3be20379e0be7de42db8367d8