Detections
Analytics
OS10-RTR-000430 - The Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
Information
Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path.Solution
Configure all eBGP routers to filter outbound route advertisements belonging to the IP core.Step 1: Add to the prefix filter list those prefixes belonging to the IP core.
OS10(config)# ip prefix-list CORE_PREFIX_FILTER seq 5 deny 20.0.0.0/24 ge 8 le 32
OS10(config)# ip prefix-list CORE_PREFIX_FILTER seq 10 deny 30.0.0.0/24 ge 8 le 32
OS10(config)# ip prefix-list CORE_PREFIX_FILTER seq 15 permit 0.0.0.0/0 ge 8
Step 2: Configure the route map referencing the configured prefix list.
OS10(config)# route-map CORE_PREFIX_FILTER_MAP 10
OS10(config-route-map)# match ip address prefix-list CORE_PREFIX_FILTER
OS10(config-route-map)# exit
Step 3: Apply the route-map inbound to each external BGP neighbor.
OS10(config)# router bgp 10
OS10(config-router-bgp-10)# neighbor 40.1.1.10
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map CORE_PREFIX_FILTER_MAP out
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# template ebgp
OS10(config-router-template)# address-family ipv4 unicast
OS10(config-router-bgp-template-af)# route-map CORE_PREFIX_FILTER_MAP out
OS10(config-router-bgp-template-af)# exit
OS10(config-router-template)# exit
OS10(config-router-bgp-10)# exit
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Dell_OS10_Switch_Y24M12_STIG.zip
Item Details
Audit Name: DISA Dell OS10 Switch Router STIG v1r1
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-269877r1052016_rule, STIG-ID|OS10-RTR-000430, Vuln-ID|V-269877
Plugin: Dell_OS10
Control ID: 44ff00963b506ad3fba74e90997020360649c3d8239bad250ec09cd860debb82