Check: CISC-RT-000530
Cisco IOS XE Switch RTR STIG:
CISC-RT-000530
(in version v2 r5)
Title
The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes belonging to the IP core. (Cat II impact)
Discussion
Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path.
Check Content
Step 1: Verify that a prefix list has been configured containing prefixes belonging to the IP core. ip prefix-list FILTER_CORE_PREFIXES seq 5 deny x.1.1.0/24 le 32 ip prefix-list FILTER _CORE_PREFIXES seq 10 deny x.1.2.0/24 le 32 ip prefix-list FILTER _CORE_PREFIXES seq 15 permit 0.0.0.0/0 ge 8 Step 2: Verify that the prefix lists has been applied to all external BGP peers as shown in the example below: router bgp xx no synchronization bgp log-neighbor-changes neighbor x.1.4.12 remote-as yy address-family ipv4 neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out If the switch is not configured to reject outbound route advertisements for prefixes belonging to the IP core, this is a finding.
Fix Text
Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below: R1(config)#ip prefix-list FILTER_CORE_PREFIXES deny x.1.1.0/24 le 32 R1(config)#ip prefix-list FILTER _CORE_PREFIXES deny x.1.2.0/24 le 32 R1(config)#ip prefix-list FILTER _CORE_PREFIXES permit 0.0.0.0/0 ge 8 Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example. router bgp xx address-family ipv4 neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out
Additional Identifiers
Rule ID: SV-221027r929070_rule
Vulnerability ID: V-221027
Group Title: SRG-NET-000205-RTR-000006
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001097 |
The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system. |
Controls
Number | Title |
---|---|
SC-7 |
Boundary Protection |