V-217059

Discussion

Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

Check Content

This requirement is not applicable for the DODIN Backbone.” 

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Verify a policy has been configured to filter AS_PATH attribute for received BGP advertisements as shown in the example below:

policy-options {
    …
    …
    …
    policy-statement FILTER_ASx {
        term ALLOW_ASx {
            from as-path PEER_ASx;
            then accept;
        }
        term ELSE_REJECT {
            then reject;
        }
    }
    …
    …
    …
    as-path PEER_ASx "^x$";
}

Note: the characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted.
Step 2: Verify that the import policy has been applied to all external BGP peers as shown in the example below:

protocols {
    bgp {
        group GROUP_ASx {
            type external;
            import [ FILTER_ASx FILTER_ROUTES ];
            peer-as x;
            neighbor x.x.x.x;
        }
 
If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.