V-216780

Discussion

Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the GIG IP core could redistribute IGP routes into BGP, thereby leaking internal routes.

Check Content

This requirement is not applicable for the DODIN Backbone.

Step 1: verify that an outbound route policy has been configured for each customer neighbor as shown in the example below.

router bgp xx
 address-family ipv4 unicast
 !
 neighbor x.12.4.14
  remote-as 64514
    address-family ipv4 unicast
     route-policy CE_ADVERTISEMENTS out
  !
 !
 neighbor x.12.4.16
  remote-as 64516
  address-family ipv4 unicast
   route-policy CE_ADVERTISEMENTS out
 !
!

Step 2: Review the route policy to determine if it is accepting only prefixes belonging to customers or the local autonomous system as shown in the example below.

route-policy CE_ADVERTISEMENTS
  if destination in CE_PREFIX_ADVERTISEMENTS then
    pass
  else
    drop
  endif
end-policy

Step 3: Review the prefix sets referenced in the route policy above to determine if they include only prefixes belonging to customers or the local autonomous system as shown in the example below.

prefix-set CE_PREFIX_ADVERTISEMENTS
  x.13.1.0/24 le 32,
  x.13.2.0/24 le 32,
  x.13.3.0/24 le 32,
  x.13.4.0/24 le 32
end-set

If the router is not configured to reject outbound route advertisements that do not belong to any customers or the local AS, this is a finding.