Detections
Analytics

JUNI-RT-000520 - The Juniper BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Information

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.

Solution

Configure the router to filter outbound route advertisements belonging to the IP core.

Configure a prefix list containing prefixes belonging to the IP core.

[edit policy-options]
set prefix-list CORE_PREFIX x.x.x.x/16

Configure a policy-statement to filter BGP route advertisements that will exclude core prefixes.

[edit policy-options]
set policy-statement BGP_ADVERTISE_POLICY term EXCLUDE_CORE from prefix-list CORE_PREFIX
set policy-statement BGP_ADVERTISE_POLICY term EXCLUDE_CORE then reject
set policy-statement BGP_ADVERTISE_POLICY term INCLUDE_OTHER then accept

Configure an export statement referencing the advertise policy on all external BGP peer groups as shown in the example below.

[edit protocols bgp group GROUP_AS4]
set export BGP_ADVERTISE_POLICY

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_Router_Y25M01_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-217057r604135_rule, STIG-ID|JUNI-RT-000520, STIG-Legacy|SV-101109, STIG-Legacy|V-90899, Vuln-ID|V-217057

Plugin: Juniper

Control ID: c9ee7c1a8d259b7be45ce8e0f0247494f850fea752db9e197e98636a3db7747a