Detections
Analytics

JUEX-RT-000430 - The Juniper BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Information

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure all eBGP routers to filter outbound route advertisements belonging to the IP core.

For example:
set policy-options prefix-list ip-core-ipv4 192.0.2.0/24
set policy-options prefix-list ip-core-ipv6 2001:db8:2::/64
set policy-options policy-statement advertise-bgp-prefix term exclude-ipv4-core from prefix-list ip-core-ipv4
set policy-options policy-statement advertise-bgp-prefix term exclude-ipv4-core then reject
set policy-options policy-statement advertise-bgp-prefix term exclude-ipv6-core from prefix-list ip-core-ipv6
set policy-options policy-statement advertise-bgp-prefix term exclude-ipv6-core then reject
set policy-options policy-statement advertise-bgp-prefix term default then accept

set protocols bgp group eBGP type external
set protocols bgp group eBGP export advertise-bgp-prefix
set protocols bgp group eBGP neighbor 192.0.2.11 export advertise-bgp-prefix
set protocols bgp export advertise-bgp-prefix

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y26M01_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-254015r844078_rule, STIG-ID|JUEX-RT-000430, Vuln-ID|V-254015

Plugin: Juniper

Control ID: 33bca5e4fb1bc070e572cd059ab7f350fedc5b250640ea002b665ff49f610996