UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Cisco BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.


Overview

Finding ID Version Rule ID IA Controls Severity
V-96603 CISC-RT-000530 SV-105741r1_rule Medium
Description
Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.
STIG Date
Cisco IOS Router RTR Security Technical Implementation Guide 2020-06-30

Details

Check Text ( C-95439r1_chk )
Step 1: Verify that a prefix list has been configured containing prefixes belonging to the IP core.

ip prefix-list FILTER_CORE_PREFIXES seq 5 deny x.1.1.0/24 le 32
ip prefix-list FILTER _CORE_PREFIXES seq 10 deny x.1.2.0/24 le 32
ip prefix-list FILTER _CORE_PREFIXES seq 15 permit 0.0.0.0/0 ge 8

Step 2: Verify that the prefix lists has been applied to all external BGP peers as shown in the example below.

router bgp xx
no synchronization
bgp log-neighbor-changes
neighbor x.1.4.12 remote-as yy
neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out

If the router is not configured to reject outbound route advertisements for prefixes belonging to the IP core, this is a finding.
Fix Text (F-102277r1_fix)
Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below.

R1(config)#ip prefix-list FILTER_CORE_PREFIXES deny x.1.1.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES deny x.1.2.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES permit 0.0.0.0/0 ge 8

Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example.

R1(config)#router bgp xx
R1(config-router)#neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out