V-216785

Discussion

The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements.

Check Content

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if it is compliant with this requirement.

Step 1: Verify that an inbound route policy has been configured for each CE router as shown in the example below.

router bgp xx
 address-family ipv4 unicast
 !
 neighbor x.12.4.14
  remote-as 64514
    address-family ipv4 unicast
     route-policy FILTER_LONG_PREFIXES in
  !
 !
 neighbor x.12.4.16
  remote-as 64516
  address-family ipv4 unicast
   route-policy FILTER_LONG_PREFIXES in
 !

Step 2: Verify that the route policy permits only routes from each CE router with a prefix  length of 24 or shorter or the least significant prefixes issued to the customer as shown in the example below.

route-policy FILTER_LONG_PREFIXES
  if destination in PREFIX_LENGTH then
    pass
  else
    drop
  endif
end-policy

Note: The inbound route policy to filter customer prefixes can be nested with the above route policy as shown in the example below.

route-policy CUST1_INBOUND_FILTER
  apply CUST1_FILTER
  apply FILTER_64514_ROUTES
  apply FILTER_LONG_PREFIXES
end-policy

Step 3: Review the prefix set referenced in the route policy above to determine if it only allows a prefix length 24 or shorter.

prefix-set PREFIX_LENGTH
 0.0.0.0/0 ge 8 le 24
end-set

If the router is not configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer, this is a finding.