← Back to RUCKUS ICX Router Security Technical Implementation Guide

V-273570

CAT II (Medium)

The RUCKUS ICX BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Rule ID

SV-273570r1110906_rule

STIG

RUCKUS ICX Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001368

Discussion

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

Check Content

Verify a prefix list exists in the config:
SSH@ICX(config)# show ip prefix-lists
ip prefix-list PREFIX-FLTR: 1 entries
     seq 5 deny 0.0.0.0/8 le 32
     seq 10 deny 10.0.0.0/8 le 32
...
     seq 999 permit 0.0.0.0/0 le 8

Confirm that prefix list is applied to BGP:
router bgp
  neighbor x.x.x.x prefix-list PREFIX-FLTR in

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text

Configure eBGP routers to reject inbound route advertisements for any Bogon prefixes.

1. Create the desired prefix list.
SSH@ICX(config)# ip prefix PREFIX-FLTR seq 5 deny 0.0.0.0/8 le 32
SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 10 deny 10.0.0.0/8 le 32
...
SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 999 permit 0.0.0.0/0 le 8

2. Apply to applicable BGP neighbors.
router bgp
  neighbor x.x.x.x prefix-list PREFIX-FLTR in