V-221106

Discussion

Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised switch within the GIG IP core could redistribute Interior Gateway Protocol (IGP) routes into BGP, thereby leaking internal routes.

Check Content

Step 1: Verify that a prefix list has been configured containing prefixes belonging to customers as well as the local AS as shown in the example below:

ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 5 permit x.13.1.0/24 le 32
ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 10 permit x.13.2.0/24 le 32
ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 15 permit x.13.3.0/24 le 32
ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 20 permit x.13.4.0/24 le 32
…
…
…
ip prefix-list CE_PREFIX_ADVERTISEMENTS seq 80 deny 0.0.0.0/0 ge 8

Step 2: Verify that the prefix lists has been applied to all CE peers as shown in the example below:

router bgp xx
 router-id 10.1.1.1
 neighbor x.55.14.2 remote-as 64514
 password 3 7b07d1b3023056a9
 address-family ipv4 unicast
 prefix-list CE_PREFIX_ADVERTISEMENTS out
 neighbor x.55.14.4 remote-as 64516
 password 3 f07a10cb41db8bb6f8f0a340049a9b02
 address-family ipv4 unicast
 prefix-list CE_PREFIX_ADVERTISEMENTS out

If the switch is not configured to reject outbound route advertisements that do not belong to any customers or the local AS, this is a finding.