V-217057

Discussion

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.

Check Content

Review the router configuration to verify that there is a filter defined to block route advertisements for prefixes that belong to the IP core. 

Verify a prefix list has been configured containing prefixes belonging to the local autonomous system as shown in the example below.

policy-options {
    …
    …
    …
    prefix-list CORE_PREFIX {
        x.x.x.x/16;
    }

Verify that a policy has been configured to not advertise prefixes belong to the core as shown in the example below.

policy-options {
    …
    …
    …
    policy-statement BGP_ADVERTISE_POLICY {
        term EXCLUDE_CORE {
            from {
                prefix-list CORE_PREFIX;
            }
            then reject;
        }
                term INCLUDE_OTHER {
            then accept;
        }
    }

Verify that the export statement as shown below references the advertise policy. 

protocols {
    bgp {
        group AS4 {
            type external;
            export BGP_ADVERTISE_POLICY;
            peer-as 4;
            neighbor x.x.x.x;
        }

If the router is not configured to reject outbound route advertisements that belong to the IP core, this is a finding.