The Cisco BGP switch must be configured to reject route advertisements from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-221029 | CISC-RT-000550 | SV-221029r945855_rule | CCI-000032 | low |
| Description | ||||
| Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE switches must be configured to reject routes with an originating AS other than that belonging to the customer. | ||||
| STIG | Date | |||
| Cisco IOS XE Switch RTR Security Technical Implementation Guide | 2025-05-20 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-000032
1.00
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
Details
Check Text (C-221029r945855_chk)
Review the switch configuration to verify the switch is configured to deny updates received from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.
Step 1: Review switch configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE switch whose AS did not originate the route. The configuration should look similar to the following:
ip as-path access-list 10 permit ^yy$
ip as-path access-list 10 deny .*
Note: The characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted.
Step 2: Verify that the as-path access-list is referenced by the filter-list inbound for the appropriate BGP neighbors as shown in the example below:
router bgp xx
neighbor x.1.4.12 remote-as yy
neighbor x.1.4.12 filter-list 10 in
If the switch is not configured to reject updates from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.
Fix Text (F-22733r408882_fix)
Configure the switch to reject updates from CE switches with an originating AS in the AS_PATH attribute that does not belong to that customer.
Step 1: Configure the as-path ACL as shown in the example below:
SW1(config)#ip as-path access-list 10 permit ^yy$
SW1(config)#ip as-path access-list 10 deny .*
Step 2: Apply the as-path filter inbound as shown in the example below:
SW1(config)#router bgp xx
SW1(config-switch)#neighbor x.1.4.12 filter-list 10 in