V-269853

Discussion

Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the GIG IP core could redistribute IGP routes into BGP, thereby leaking internal routes.

Check Content

This requirement is not applicable for the DODIN Backbone. 

Review the router configuration to verify that there is a filter defined to only advertise routes for prefixes that belong to any customers or the local AS.

The prefix filter must be referenced outbound on the appropriate BGP neighbor statements.

Step 1: Verify prefix lists have been configured for each customer containing prefixes that belong to that customer.

OS10# show running-configuration prefix-list
!
...
ip prefix-list PREFIX_FILTER_A seq 5 permit 50.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 10 permit 60.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 15 deny 0.0.0.0/0 ge 8
...

Step 2: Verify the route map applied to the external neighbors references the configured prefix list shown above.

OS10# show running-configuration route-map
!
route-map PREFIX_FILTER_A_MAP permit 50
 match ip address prefix-list PREFIX_FILTER_A

Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above.
 
!
router bgp 10
 !
 neighbor 50.1.1.1
  !
  address-family ipv4 unicast
   route-map PREFIX_FILTER_A_MAP out

If the router is not configured to reject outbound route advertisements that belong to any customers or the local AS, this is a finding.