CISC-RT-000550 - The Cisco BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

Solution

This requirement is not applicable for the DODIN Backbone.

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that do not belong to that customer.

Step 1: Configure the as-path ACL as shown in the example below:

R1(config)#ip as-path access-list 10 permit ^yy$
R1(config)#ip as-path access-list 10 deny .*

Step 2: Apply the as-path filter inbound as shown in the example below:

R1(config)#router bgp xx
R1(config-router)#neighbor x.1.4.12 filter-list 10 in

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_IOS_XE_Switch_Y22M07_STIG.zip

Item Details

References: CAT|III, CCI|CCI-000032, Rule-ID|SV-216693r531086_rule, STIG-ID|CISC-RT-000550, STIG-Legacy|SV-106097, STIG-Legacy|V-96959, Vuln-ID|V-216693

Plugin: Cisco

Control ID: 7d7c818dc5b4152cad4a2d413168c8d3c174a22f0654c48bcab980c9d79d4679