CISC-RT-000500 - The Cisco BGP switch must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Information

Accepting route advertisements belonging to the local AS can result in traffic looping or being black-holed, or at a minimum, using a non-optimized path.

Solution

Review the switch configuration to verify that it will reject routes belonging to the local AS.

Configure the router to reject inbound route advertisements for any prefixes belonging to the local AS.

Step 1: Add to the prefix filter list those prefixes belonging to the local autonomous system.

SW1(config)#ip prefix-list PREFIX_FILTER seq 74 deny x.13.1.0/24 le 32

Step 2: If not already completed to be compliant with previous requirement, apply the prefix list filter inbound to each external BGP neighbor as shown in the example.

SW1(config)#switch bgp xx
SW1(config-switch)#neighbor x.1.1.9 prefix-list PREFIX_FILTER in
SW1(config-switch)#neighbor x.2.1.7 prefix-list PREFIX_FILTER in
SW1(config-switch)#end

Item Details

Audit Name: DISA Cisco IOS XE Switch RTR STIG v3r4

Category: ACCESS CONTROL

Plugin: Cisco

Control ID: f66a0c91eb9309276b55ed1ec8d8e51b40de7540ff399ee8b210faee810d777f

Detections

Analytics

CISC-RT-000500 - The Cisco BGP switch must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Information

Solution

See Also

Item Details