V-216779

Discussion

As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multi-homed customer with BGP speaking routers connected to the Internet or other external networks could be breached and used to launch a prefix de-aggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.

Check Content

Review the router configuration to verify that there are ACLs defined to only accept routes for prefixes that belong to specific customers. 

Step 1: Verify that an inbound route policy has been configured for each customer neighbor as shown in the example below.

router bgp xx
 address-family ipv4 unicast
 !
 neighbor x.12.4.14
  remote-as 64514
    address-family ipv4 unicast
   route-policy CUST1_PREFIX_FILTER in
  !
 !
 neighbor x.12.4.16
  remote-as 64516
  address-family ipv4 unicast
   route-policy CUST2_PREFIX_FILTER in
 !
!

Step 2: Review the route policies to determine if it is accepting only prefixes belonging to each customer as shown in the example below.

route-policy CUST1_PREFIX_FILTER
  if destination in CUST1_PREFIX then
    pass
  else
    drop
  endif
end-policy
!
route-policy CUST2_PREFIX_FILTER
  if destination in CUST2_PREFIX then
    pass
  else
    drop
  endif
end-policy

Step 3: Review the prefix sets referenced in the route policies above to determine if they include only prefixes belonging to each customer.

prefix-set CUST1_PREFIX
  x.1.1.0/24 le 32
end-set
!
prefix-set CUST2_PREFIX
  x.2.1.0/24 le 32
end-set

Note: Routes to PE-CE links within a VPN are needed for troubleshooting end-to-end connectivity across the MPLS/IP backbone. Hence, these prefixes are an exception to this requirement.

If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.