Detections
Analytics
CISC-RT-000550 - The Cisco BGP switch must be configured to reject route advertisements from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.
Information
Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE switches must be configured to reject routes with an originating AS other than that belonging to the customer.Solution
Configure the switch to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.Step 1: Configure the as-path ACL as shown in the example below:
SW1(config)# ip as-path access-list AS_PATH permit ^22$
SW1(config)# ip as-path access-list AS_PATH deny .*
Step 2: Apply the as-path filter inbound as shown in the example below:
SW1(config)# router bgp xx
SW1(config-router)# neighbor x.1.12.2
SW1(config-router-neighbor)# address-family ipv4 unicast
SW1(config-router-neighbor-af)# filter-list AS_PATH in
SW1(config-router-neighbor-af)# end
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Cisco_NX-OS_Switch_Y26M04_STIG.zip
Item Details
Audit Name: DISA Cisco NX OS Switch RTR STIG v3r4
Category: ACCESS CONTROL
References: 800-53|AC-4(8), CAT|III, CCI|CCI-000032, Rule-ID|SV-221109r1137905_rule, STIG-ID|CISC-RT-000550, STIG-Legacy|SV-111037, STIG-Legacy|V-101933, Vuln-ID|V-221109
Plugin: Cisco
Control ID: e09c935f03e8630e2c6c1d918c5eb111ac8db9038f09f572d3c477cb9333448e